Security in medical imaging systems is a serious concern for institutions, as data breaches can compromise patient care and result in GDPR violations. BMD Software takes these concerns very seriously and is constantly updating its products in order to bring comfort to institutions that decide to rely on our solutions.
PACScenter is a web-based professional and enterprise PACS system. It transforms normal web browsers into fully capable workstations for medical imaging review. This article will explore the several mechanisms in place to guarantee a safe and secure operation of PACScenter.
Authentication/Authorization
Authentication, commonly associated with the login operation, is a security mechanism that ensures that the user accessing a resource is who they claim to be. PACScenter employs several strategies to authenticate users and third-party services:
- Lightweight Directory Access Protocol (LDAP)/Active Directory (AD) are a set of centralized services to control user access to organization resources. These systems are used by organizations to store access credentials and associate them with resources that the user has access to.
- Single Sign-On (SSO) is a mechanism that allows users to only authenticate once and have access to a variety of independent services located within the same network. It is useful for institutions who possess several distinct and independent services but share the same users.
- Token-based authentication is an alternative way to authenticate users in PACScenter. It allows third-party systems to request authentication tokens from PACScenter that can be used in subsequent requests to bypass the login. These tokens have a short life span and are meant to be used by third-party systems to easily integrate PACScenter.
- API Secret/Key is a mechanism geared towards integration with third-party systems. It provides secure mechanisms to expose platform endpoints (such as study search in PACScenter) to other services.
Authorization is a security mechanism that stipulates the permissions of a user in the platform. It is used in PACScenter to control the functionalities available to the logged-in user or third-party services that are using the API. PACScenter uses a Role-based Access Control (RBAC) system to authorize users. When a user is authenticated through the aforementioned systems, a role is assigned to him that dictates his permissions in the platform. It is possible for example to create a technician and doctor profile, where the technician can access user worklists and other operational controls within PACScenter and the doctor can access the search page and the medical images.
Audit Trail
Audit Trail is used in PACScenter to provide a detailed record of all the user actions on the platform. It is only accessible by platform administrators, and it can be used to monitor user activity. This mechanism is important as it allows the detection of unusual activity and keeps a detailed record for auditing. Only the device information is stored in these records, no personal information is used.
Data Privacy and Encryption
When dealing with patient information, data privacy and security is of utmost importance. BMD Software is committed to providing transparent and secure mechanisms to store patient data. This is the reason why the open-source PACS archive Dicoogle is used. An open-source solution is publicly audited and fully transparent, being possible to verify the privacy and confidentiality of the data stored in the PACS.
In addition to using open-source components, PACScenter can be easily installed within the institution network, using their own hardware. The patient data never needs to leave the institution, guaranteeing full data privacy.
Data encryption is an extra layer of security institutions can implement in order to secure the patient data. It can be used to prevent data breaches in case of a cyberattack. PACScenter supports the encryption of the full patient dataset in Dicoogle, keeping the patient data safe in case of an attack.
Data Backups and Service Availability
Another vertex of security in medical systems is data redundancy and service availability. It is of paramount importance to guarantee high service availability, as to not compromise patient care. Service downtime can cause issues in the doctors’ workflow and, most importantly, delays in diagnosis. It is for this reason that PACScenter supports a fully distributed multi-node architecture that can be monitored through services such as Nagios, Cloudwatch, etc.
Another important aspect to consider is resilience to ransomware attacks. Even with the data encrypted, attackers can still steal your information, which can have catastrophic effects, resulting even in data loss. PACScenter tackles these issues through robust data backup mechanisms. It is possible to automatically back up the data upon arrival in the PACS by sending it to another PACS node through the Store&Forward mechanism. Alternatively, the system can also be configured to export data to a persistent volume, such as an external disk. This system is built with resilient and scalable technologies such as Kafka that guarantee service availability and resilience to failure.
This system combined with data encryption provides full protection of the data from malware attacks.
Data Anonymization
Data anonymization is important in research environments, as it allows the sharing of data without compromising patient anonymity, which is crucial to abide by the GDPR regulation.
PACScenter provides several mechanisms to anonymize the patient data:
- Anonymized study download. Studies can be downloaded directly from the PACScenter user interface, where it is possible to choose the attributes to anonymize. It is possible to anonymize all the metadata and pixel data. Institutions can define anonymization profiles to streamline this process. These profiles configure which data is to be anonymized, and are useful for example to have different anonymization options for different projects.
- Anonymization gateway. PACScenter supports the automatic anonymization of studies upon arrival in the PACS. The anonymization profiles, explained in the previous point, can be used here to configure how the studies are to be anonymized. It is possible to automatically send these studies to other PACS servers, for easy sharing of data in an anonymized way.
Conclusion
This article explored the systems and mechanisms used in PACScenter to guarantee data privacy and security. The systems presented allow the use of the platform, with possibility of third-party integration, securely. BMD Software takes this issue very seriously and is constantly improving its solutions to provide the utmost security. Check out the web page for more information.