Risks of picture archiving and communication systems

The tender specification document

This specification must be based upon a detailed analysis and complete understanding of current and desired radiological workflow, in its entirety – from the booking process right through the acquisition of images, the reporting process and the dissemination of results – with each step in the pathway clearly described in unambiguous detail. This is the specification to which the successful Vendor signs up, and the risk associated with inadequacy of this document is that there is no comeback on the company if the system they later provide fails to meet expectation. This could be either because the specification was not made in sufficiently precise detail and is open to ambiguity of interpretation, or because elements of the desired system were omitted from the specification altogether, either in error because they were overlooked, or because they were taken for granted and not put down in writing. The company can only be held to account if the requirements of the system are specified in precise detail in the tender document.

The description of the imaging workflow should be in clinical practical terms, rather than technical terms. It is up to the Vendor to propose how those specifications can best be met technically. Writing the specification document requires considerable work by the Trust going to tender, but is an investment of time which will bring dividends later. Clearly, it is sensible to use any recent PACS tenders submitted by Trusts with a similar workflow requirement, but every tender will need considerable customisation to make it directly relevant to the individual case.

After the contract has been awarded, many vendors try to barter over particular details in the specification document, with the aim of making them equate more easily to the system they already have as a product. Do not be tempted to compromise and acquiesce to such requests: the company has committed to provide a system as specified in the tender document and it is their responsibility to do so.

The contract

The contract document must be written in the correct legal format to safeguard both parties: the Trust and the Vendor, ensuring that each meets their contractual commitments. Generally, it is more a question of the Trust protecting itself against the lack of timely delivery of their system, and against the risk that the system delivered is later found not to be fit for purpose when installed. The contract must therefore contain clear penalty clauses which can be invoked if there are delays in the implementation of the system due to the company, or if the system delivered is not fit for purpose, or fails to fulfil the agreed specification document in a major way which impacts upon workflow and clinical functionality.

It is important that the contract makes provision for the responsibility of both parties in the regrettable circumstance of there being an irretrievable breakdown of the Purchaser–Vendor relationship leading to the termination of the contract. It is essential that the Trust has access to a usable system to maintain its clinical workflow at all times. It is clearly desirable that legal proceedings, which are generally lengthy and costly, should be avoided under such circumstances if possible.

It is essential that the contract specifies the responsibility of the Vendor in migrating the archived data at the termination of the contract (whether that be at the end of the system lifetime, or at premature termination of the contract). Although the majority of PACS projects now incorporate a ‘vendor neutral archive’ (VNA) facilitating the accessibility and extraction of archived data, this per se, does not allocate responsibility for the smooth migration of these data and accurate viewing of them in their entirety by a different future PACS.

It is strongly recommended that a contracts expert be employed to write and implement the contract. That person should be experienced not only in imaging IT (information technology) but also in the highly specialised arena of PACS contracts.

The PACS contract should become a living document throughout the life of the system and be kept up to date, so that it accurately reflects the state of the whole system. Any changes that are made to the system should be added to the original contract as formal ‘change control notices’ (CCNs). Without such an accurate record the risk it that it is later impossible to remember or trace what changes were made, why, and by whom, and to allocate responsibility if things go wrong.

The network and hardware

It is crucial that the network is of sufficient quality and bandwidth to move the huge amounts of data contained in imaging studies around quickly and reliably. Just because a network might have a specified capacity of, say, 1 GB, does not necessarily mean that the whole of that 1 GB is available for dedicated use by PACS imaging traffic at any one time. This has to be specified and tested objectively. It is a major threat to PACS functionality if a suboptimal network causes system or individual workstation crashes, or causes the system to function slowly.

Once a hospital (or other healthcare institution) has become filmless and paperless with respect to imaging, there is no fallback position. The hospital/healthcare institution no longer possesses perishable unexposed film, nor the imaging equipment to use this analogue film. The space for an analogue film-based archive will have been redeployed. Secretarial staff previously typing imaging reports will no longer be employed once speech recognition is integrated with the RIS/PACS. ² The whole of modern medicine and surgery, especially acute practice, is totally dependent upon imaging, and imaging is totally dependent upon its PACS. Imaging is central to patient investigation, diagnosis, treatment, and follow up management. If the PACS fails, or impairs the efficiency of the imaging department by functioning suboptimally, the whole of acute healthcare in that institution will fail relatively quickly (within hours), and elective healthcare will also fail (within a few days). The PACS network and the system hardware (archives, workstations, etc.) must reliably support full functionality of the system 24/7.

PACS workstations must have the requisite amount of memory and processing power to support the software programmes running, and imaging data being handled. PACS software upgrades can change the hardware requirements during the life of a PACS. The current attraction of thin client technology in PACS is that the processing of huge image datasets is carried out centrally on the server, reducing the demands at the level of the individual workstation and the network.

Modern demands in the UK for a 24 hour, seven-day working healthcare service mean that radiologists and other clinicians must have easy access to their PACS, and its related technologies, (which for radiologists includes their speech recognition system) from home, and the ability easily and securely to view imaging studies from hand-held devices such as tablets. It is important to avoid diagnostic risk caused by limitation of screen display resolution, brightness, and size of monitor real estate of these mobile devices, by carefully testing their diagnostic capability and by specifying their use in the imaging pathway: i.e. review versus primary reporting. ³ The requirements to support 24/7 working must also be clearly specified in the contract, or they risk not being provided.

The introduction of regional multisite multidisciplinary team meetings (MDTMs) into British healthcare, has led to a need for PACS networks and hardware to support such meetings with appropriate teleconferencing facilities. There is considerable risk associated with any technical failure of such teleconferencing involving the display of images or the audio transmission: crucial decisions on patient management often have to be postponed without adequate review and discussion of the imaging, risking delay in patient treatment, and breach of turnaround times specified by cancer care pathways.

The software functionality

The PACS software should be easy to use and intuitive, yet with an intrinsic complexity which allows the imaging workflow to function efficiently, and the radiologist to do his/her work quickly, concentrating upon interpreting the images, without being distracted by ‘clunky’ manipulation or slow functionality of the system.

It is important to appreciate that the average non-radiological clinician user of the PACS only requires relatively basic, but intuitive software manipulation. (S)he needs, without special training, to be able quickly to access the relevant imaging studies on his/her patients, simultaneously viewing previous imaging studies if desired, with some basic software manipulation of the images, such as changing contrast width and level, CT (computed tomography) contrast width and level presets, magnification; and to be able to view large multislice datasets with rapid stack mode scrolling. Providing too much software complexity on a basic ward or clinic setting PACS risks overwhelming the clinicians and having even the basic software underused. Specialist clinicians, such as orthopaedic or vascular surgeons, who wish to manipulate the image data in specific ways, for example to calculate the appropriate hip prosthesis or aortic graft size to use in advance of an operation, will require access to dedicated specialised software, preferably integrated into the PACS software, to make such assessments.

It is the radiologist who requires slick state-of-the art PACS software in his/her everyday reporting work.^4,5 Fully integrated multiplanar (MPR) and maximum intensity projection (MIP) software for cross-sectional imaging is an absolute minimum requirement, and fully integrated additional specialist post-processing software programmes (usually from a third party vendor) are to be expected nowadays. It is no longer acceptable for the radiologist to have to log into a different workstation, or launch non-integrated software programmes (without single sign-on), and have to transfer the study already open on the PACS, in order to perform post-processing manipulations upon the images, and then send these to PACS. The radiologist also requires dedicated reporting software which automatically skips over exams in a list of studies waiting to be reported, if those exams are already being accessed by a radiological colleague at another workstation (in the same or different institution) who is already in the process of reporting the study. If such software is absent there is a constant risk of work being duplicated and time wasted.

Demands upon PACS software, or PACS-integrated software, are even greater by radiologists working in institutions where teaching, research and tertiary referral image review form a major part of their work. Inadequacy of the PACS software in these areas, e.g. the absence of a comprehensive, searchable, integrated digital teaching library, risks these radiologists being unable to carry out their expected roles in these domains, or attempting to do so with much frustration caused by failure of the PACS software to provide adequate functionality.

MDTMs require special conferencing software on PACS. The names, demographic and clinical details of patients to be discussed at the conferences must be accessible from PACS. Such software must allow radiologists to prepare for such meetings by pre-arranging, and storing for later display, selected images (usually from multiple imaging studies, and often acquired at different locations), on specific patients to be discussed at the conferences. MDTMs have highlighted the need for the electronic patient record to be easily accessible from the PACS and vice versa. The risks of having various silos of standalone data on patients, residing in different unconnected digital systems, are very concerning: in particular, not knowing that a patient has had previous imaging elsewhere, or previous investigations revealing important clinical information, can be dangerous regarding decisions on future medical or surgical management of the patient.

It is essential that the RIS and the PACS function as one seamless, integrated, unified system and there are very considerable risks to the hospital workflow if this is not the case. The RIS is responsible for all the administrative tasks of the workflow involving every aspect of patient imaging appointment bookings, and also the (legally required) statistics associated with NHS patient throughput in the Imaging Department. If the intrinsic functionality and/or the performance of the RIS is inadequate (especially if it is not customised to the demands of the British National Health Service when being used in the UK), then this impacts upon the entire imaging workflow, with the risks of increasing waiting lists for imaging appointments, delaying feedback of imaging reports, compromising diagnosis and treatment, and causing the hospital to fail national patient pathway statistical requirements.

System maintenance

This can be divided into in-house and external system maintenance. The contract must specify that the Vendor will supply regular upgrades and updates to the PACS throughout the life of the system to maintain it state-of-the art. Nowadays vendor maintenance (generally to guarantee 99.8% uptime of the system) is carried out remotely via a 24/7 dial-in system, rather than having permanent on-site engineers. The PACS contract should clearly state what is meant by ‘PACS downtime’ (resulting in the inability to carry out normal imaging workflow) and the penalties which will apply if the contract specifications are breached.

In-house maintenance of the PACS requires dedicated personnel since the issues are so specialised that the hospital IT personnel will be unable to fulfil this role. It also requires at least one such person ‘on the ground’ per site to diagnose, and if possible, fix, the cause of the PACS problem, which will not be evident to the radiologist or other clinician. The obvious risk of a workstation or system malfunction is that the radiologists cannot carry out their work, and the other clinicians cannot view imaging studies and reports on the patients under their care.

It would require more than one PACS manager in-house to overcome the risk of not having redundancy of cover when this person goes on holiday, is ill, or is unavailable for some other reason. One successful way of overcoming this risk is to train a team of ‘hands-on’ PACS radiographers to fulfil this role, rotating through the post for a week at a time so that they maintain their radiography skills in addition to their PACS troubleshooting role. Having a radiologist who leads on PACS, and PACS-related IT issues, from the clinical perspective, guards against the risk of radiologists using the system suboptimally, or them having to put up with the system itself under performing.

Data migration

It is essential that the responsibility for the eventual migration into a new system, of the huge amounts of data accumulated within a PACS over its lifetime, should be assigned in the contract at the outset of the PACS project. This was an area which was largely ignored in many early PACS implementations. Otherwise, there is a very significant risk that such data migrations will be very costly, time consuming and difficult; especially if the modality or archive vendors have introduced lots of private DICOM (digital image communication in medicine) attributes in the process of image acquisition and/or storage, rendering those data unreadable by other vendors’ systems after migration.

The main idea behind ‘the vendor neutral archive’ was to avoid this migration risk. The VNA is supposed to be able to ‘hook up’ to any other PACS/related hardware, obviating the need to migrate data when the PACS or RIS Vendor is changed. Again the PACS contract must be carefully worded to mitigate any potential risk associated with which company has responsibility for maintaining the accessibility and integrity of the data, and for satisfactory data management.

Patient risk

Many of the potential risks of PACS and digital imaging data have been greatly exaggerated when compared with the far greater risks previously existing when such data were in analogue format (hard copy x-ray film and paper reports). Prior to the PACS era, there was little awareness by the general public of these genuine risks to their data.

There is always the real risk that a patient’s digital images will inadvertently be placed in the wrong digital folder (one belonging to a different patient), or will not archive correctly into their assigned folder and become ‘orphaned’ or ‘unspecified’ in the PACS archive. Another possible scenario is that two patient records can arise on PACS, with slightly differing demographic details, and are thought to belong to the same patient, and are electronically merged without the necessary cross-correlation of sufficient demographic fields. If, in fact, they really belong to different patients whose demographic details are indeed slightly different, that would pose a very significant risk, especially since the merger would not necessarily be readily picked up if it is performed automatically, and can be difficult to reverse. All these (sometimes human) errors can be avoided if the PACS has sufficient in-built checks and constraints to prevent such risks; and if administrative and radiographic staff are carefully trained in how to operate the system, and are conscientious about following agreed work procedure protocols. If such mistakes do arise, they can be corrected promptly by having an in-house support team, generally of trained radiographers as described above under ‘system maintenance’. In fact such risks were equally present when film was used: the sheets of film could be inadvertently labelled with the wrong patient name, or could be filed in the wrong cardboard packet, or could be lost altogether (since there was only one physical copy of each piece of film and no back up).

When hard copy film was used, the name and other demographic details of the patient appeared on every sheet of film, and could be read directly by anyone looking at the piece of film. These film packets were frequently sent from one hospital to another by routine surface mail, when a review of the imaging was needed, or if the care of the patient was transferred to a different healthcare institution. Clearly the packet containing these sheets of film was exposed to the risk of being damaged or lost in the post, or being illegally opened by anyone with whom it came into contact.

There were considerable risks associated with the hard copy archives of film, present in every hospital. Since there was only one copy of the data – stored on film – if the film archive were destroyed by a fire, or a local flood for example, all those data were irreparably lost. Previously in almost all hospitals at night, or at weekends, the film packet store was either left open and unstaffed by film-filing clerks, or was locked and out-of-bounds to doctors and all healthcare personnel. The risks associated with either scenario are obvious. If the film store was open to anyone there was clearly no monitoring of who came and took away packets of films, even though the person taking the film packet was supposed to sign for it stating its destination. If the film packet store was inaccessible to doctors at night, and a patient with previous imaging was admitted as an emergency, his/her acute care could well be compromised by the lack of availability (or knowledge) of important past imaging for comparison.

Security is vastly improved by PACS, its digital archive and network, allowing images to be viewed simultaneously in multiple locations by those with an appropriate validated secure password. The archive of almost all PACS nowadays is backed up at a different remote location as a ‘disaster recovery’ solution ⁶ for greater protection against physical damage, and this needs to be specified in the tender document.

In the aftermath of various ‘scandals’ in the UK several years ago when at least one laptop containing databases of personal information was left on a train, ⁷ a government edict was issued that all removal media (CDs, DVDs, USBs) containing imaging data (digital imaging studies and their reports) had to be encrypted before being sent in the post or transferred directly from one healthcare site to another. The decryption code had to be conveyed to the recipient site under separate cover. Unfortunately these measures led to far more risk to patients than they purportedly solved. Such risks included the inability to decrypt the data at the receiving site, for a variety of reasons, such as: the decryption code did not work, or it was not sent, or it was lost in transit.

The transfer of digital imaging data using removable media in itself poses significant risks to timely patient care which did not exist with film. There may be an incompatibility between the software used on the removable media and the software used at the receiving site (often because one of the vendors is using private DICOM attributes associated with the images which are not supported by the other vendor’s software) making it impossible to display the images; or there may be no self launching DICOM viewer associated with the images on the removable medium, making it impossible for the images to be viewed on a simple computer which is not connected to the internet to enable downloading of an appropriate DICOM viewer, for example (which in itself is a time-consuming task requiring some basic knowledge of DICOM viewers). If a patient is transferred urgently for emergency care (for example for operation on a dissecting aortic aneurysm at a regional centre undertaking such specialist operations) and his/her imaging is not immediately available for review at the receiving hospital (for a variety of possible reasons), then the patient has to be re-imaged (usually by a repeat CT scan) as an emergency prior to the operation, wasting valuable time and delaying the urgent operation, as well as exposing the patient to an unnecessary further dose of irradiation. Frequently, the imaging report issued by the radiologist at the sending site was not sent as part of the imaging study (and still is frequently not sent, even today), making it necessary for another radiologist at the receiving site to re-interpret the imaging study, which is not only an unnecessary and time-consuming duplication of professional work, but usually puts the radiologist at the recipient site at a disadvantage since (s)he is forced to interpret the imaging study in isolation without reference to the clinical scenario or to previous imaging. It may be difficult, or occasionally impossible, to upload the outside imaging studies and their reports to the recipient RIS/PACS as a permanent record. Often this difficulty is caused by a manpower issue of not having the appropriate staff available to perform this task, rather than due to its technical difficulty.

It is usually essential for any radiologist (or other clinician) interpreting a particular imaging study on a patient, to have simultaneous access to the previous imaging studies on that patient, particularly to those where the same body part was imaged. For example, when interpreting a chest x-ray on a patient, that patient’s previous chest x-rays and any previous CT scan of the chest, should be available for comparative viewing by the radiologist interpreting the current chest x-ray. There are several reasons why there is this need to review previous relevant imaging, and the reports of those previous imaging studies, in order properly to interpret the current imaging study. One reason is to allow the radiologist to interpret the significance of any abnormal finding on the current imaging study. If, for example, an area of density seen in the region of the lung on a chest x-ray turns out to have been present, and looked identical, on a chest x-ray six years previously, it can be dismissed as a harmless benign finding and not a lung cancer. However, if a density seen in the lung on the current chest x-ray was not present on a chest x-ray from a year ago, that increases the likelihood that it may represent a lung cancer and requires urgent further investigation. Another related reason is to allow the radiologist to assess the progression or resolution of an abnormal finding previously present, such as whether the patient’s pneumonia is improving or not. If it is getting worse then it is likely that a change in the patient’s clinical management (such as different antibiotics) will be necessary. Thus if the requisite previous imaging studies are not available to the radiologist at the time of reporting the current imaging examination, this compromises the quality of the report that can be issued and represents a significant risk to the healthcare of the patient.

This risk of not being able to display previous relevant imaging studies at the time of reporting can arise for several reasons. If the previous imaging was performed in the same institution and stored on the same PACS, it should have been automatically retrieved from the long term archive to the short term archive of the PACS by prefetching rules, and therefore be available for display with the current study at the time of reporting. If it is not, this could be because the prefetching rules have failed, or because there is a problem with dearchiving data from the long term store. This equates to the risk with the old film-based imaging when the old films were missing because they had been lost or misfiled, or when the entire old packet of x-rays was not presented to the radiologist at the time of reporting, which might have been due to human error, or because the film packet itself was lost, or in use at a different location in the hospital, for example.

A major unresolved risk with PACS, which has not improved since the analogue age of a film-based system, is the lack of knowledge by any single RIS/PACS network that the patient has previously had imaging studies elsewhere, so clearly such previous relevant imaging performed in a different institution will not be available for comparison at the time of reporting the current study, and will not even be known to exist, unless the patient volunteers this information or its existence is known about, and mentioned, by the referring doctor. In England, the Government’s Connecting for Health (CfH) original intention to build large regional PACS archives for each of the five Local Service Providers’ PACS’, each with a master patient index (MPI), was intended to solve this problem at a regional level but was never fully implemented, due to the cost, the complexity of the software and data management systems required, and the failure of the project to have a ‘National Spine’ healthcare record of every English patient.

These risks led to the UK Government’s support for the IEP (image exchange portal) which uses N3 (national NHS network) as a secure network over which imaging studies and their reports can be sent directly from one NHS hospital to another without the need for removable media. Information governance (IG) agreements were established between all NHS hospitals to allow these data legally to be transferred and viewed. The IEP has been a significant step in mitigating risk, but the IEP remains a rather basic and non-automatic process in need of considerable development.

When it is realised that a patient has had previous imaging studies at another British hospital, which it would be relevant to review in conjunction with the current imaging study, these must be sent by the IEP, as described above. The IEP, being a cumbersome, slow and labour-intensive process, certainly does not function in real time, as would be necessary to allow immediate comparison with the patients’ previous imaging studies. The IEP is hampered by IG rules, and individual Trust firewalls, which will not permit the IEP or any external institution access to search the databases of Trusts’ RIS and PACS (in a ‘query-retrieve’ manner). Previous imaging studies on any patient must be individually and specifically requested by one Trust from another, and sent over the IEP, and then (commonly) uploaded to the recipient Trust’s RIS and PACS which may be a manual process, which in itself duplicates digital storage across the country. The lack of use of one numbering system for patients in hospitals throughout the UK, and the continued use of local patient identifiers (local system-specific numbering systems) in addition to the NHS number, further complicates the issue and hampers the efficient, timely transfer of imaging data across the country.

When XDS-I (cross platform document sharing for imaging), as specified by the IHE (integrating the healthcare enterprise) eventually becomes incorporated into RIS/PACS throughout the UK and worldwide, this difficulty of locating and sending digital imaging studies from a digital archive housed on one site to another, will be greatly reduced. ⁸ Unfortunately, the widespread implementation of XDS-I is still many years away (probably at least five years), although it essential that it is specified as an essential requirement in any new current RIS/PACS tendor. There is far less risk relating to imaging data transfer and sharing in Northern Ireland and in Scotland, since within each of these countries a single patient hospital numbering system is used, and the vast majority of the hospitals in each country use the same RIS/PACS from the same vendor. These two practices alone have greatly enhanced integrated seamless working within both countries, and reduced the associated patient risk.

When PACS, and the electronic storage of personal imaging data, were first introduced, there was an overreaction by some members and groups of the lay public to their perceived risk that these data were potentially open to abuse: for example inappropriate viewing by unauthorised personnel. Curiously, the widespread extant use of other digital systems to archive equally personal information: as in banks, passport records, supermarket check-outs, etc. did not arouse any such concern. Clearly, it is essential that the PACS should have robust, easily accessible and permanent audit trails, of who has viewed which images, when, and where, so that any suspicion of breach of patient confidentiality by the inappropriate viewing of their imaging and report data, can be investigated easily and exposed in a timely fashion, with medicolegal consequences if necessary. ⁹ In my view it is far better for the patient if security of patient data is maintained by the deterrent of the existence of such audit trails, than if there is rigid restriction imposed by IG ‘rules’ of who can view which patient’s imaging studies, since the latter approach has the inherent even greater risk of harming the patient in an emergency situation resulting in the appropriate doctor (who would not, under normal circumstances, be expected to have to look at that particular patient’s imaging studies) being unable to gain quick legitimate access to viewing the patient’s imaging. An example of the latter possibility is the scenario where a patient is, say, admitted with a cardiological problem, with viewing of his imaging data restricted to the team of cardiologists looking after him, which sounds superficially logical. If, then, the patient suddenly has a heart attack in the middle of the night, becoming acutely seriously unwell, and is transferred from the cardiology ward to the Intensive Care Unit, it could be very damaging to that patient if the intensive care doctors, now unexpectedly looking after him, were denied access (by overly strict IG rules) to his imaging data at night when they most need it for the acute management of the patient.

Another issue which caused concern to some lay people was whether or not every patient should be required to give his/her active consent to the digital archiving of his/her data (as opposed to an ‘opt out’ approach). This was logistically simply not a practical option in the National Health Service. Gathering and recording such consent would be very time consuming, and would be impossible for the unconscious patient and for the patient not speaking English, risking delaying their treatment. Such consent for the digital storage of data has never been raised in other walks of life where there is no option, such as in the banking service or the taxation registry, etc. Once an institution has introduced PACS, there is generally no alternative method of imaging a patient other than digitally, with associated automatic archiving of the acquired data. Thus, even for patients who might choose to ‘opt out’ and withhold their consent to digital imaging and/or archiving, there is now no other technology in place whereby they could have an imaging study performed or stored. It would be rather like a tourist wishing to make a long haul flight, insisting upon only using a propeller-driven plane, and refusing to use a jet plane.

There has been no change in the lack of formal consent from a patient when his/her imaging studies are sent to a tertiary referral centre for review, or for consideration in an MDTM. No such consent was obtained when the films were sent by post, and there is no mechanism in place now for such consent to be obtained or recorded when the digital imaging studies are sent via the IEP or on removable media. Clearly such referrals are only ever made in the best interests of that patient, and although the images will be reviewed, unanonymised, in fora where there are medical staff who have never met (and often will never meet) the patient, the risk of breach of confidentiality is no different from that in the primary hospital, and would be a punishable offence. In the UK there is generally acknowledged ‘implied consent’ whereby if a patient agrees to admission to, or outpatient care in, a hospital, it is reasonably presumed that (s)he is in agreement with that institution providing medical care to the best of its ability, which may include seeking tertiary referral or teleradiology.

In research projects involving personal data, formal recorded patient consent is obligatory. Publicly shared archives of image data are an increasingly critical element of cross-disciplinary research, especially for clinical biomedical research where diagnostic images of the spectrum of human disease and its response to therapy are in limited supply, and need to be accessed by multiple different research groups often in varying scientific contexts. Large open-access DICOM image archives for research purposes that can be queried to correlate with specific scientific questions, (such as genetics), will only achieve their valuable scientific potential if there is international confidence in a robust, risk-free framework for de-identification meeting the privacy regulations, as described by Freymann et al. ¹⁰

When imaging was provided by film and paper reports, the report formed the legal record in the UK and it was recommended that the films also be kept for seven years (except in special categories of patients such as the paediatric and mentally compromised populations where records are held for longer periods). Now that digital image archives can be easily and cheaply stored for long periods of time, questions have been raised as to the necessity, desirability and legality of long-term storage of patient imaging data. Some have even suggested that doing so amounts to an infringement of personal liberty. This is a very difficult area to address and legislate upon since there are few clear hard data and no precedents upon which to base a decision, and any such ‘ruling’ will inevitably be, in large part, arbitrarily based upon subjective assessments of potential patient benefit versus risk. The considerations are similar to those involved in the storage of DNA samples from suspects in criminal investigations, and film records from public surveillance cameras. Most modern RIS/PACS do now provide the means to delete imaging studies permanently from their archives, known as ‘information lifecycle management’, but as yet this has not been implemented in practice due partly to the lack of precedent, and partly to the complexity and lack of clarity of the rather limited legal time retention requirements that do exist, which would require numerous different deletion rules to be set up. It would seem most sensible, in the first instance to set up a ‘catch all’ rule of, retaining these data for, say, 26 years, which would cover all the current legal requirements in the UK (including paediatric, medicolegal, etc.), but would inevitably also lead to many imaging data being retained for unnecessarily long periods. However individual healthcare institutions could then gradually refine their information lifecycle management rules tailoring them to the requirements of the various patient categories, including the probable need to retain data for patients consented for inclusion in research studies for specified periods of time.

Conclusion

The minimisation of risk in a PACS, and its related digital technologies, requires paying careful attention to all aspects of the implementation and functioning of the system, including: the tender specification document, the contract, the network and hardware, the software functionality, maintenance of the operational system, and ultimate data migration when the system is changed.

I have no doubt that, provided reasonable, basic precautions are taken, the digital acquisition, storage and transmission of imaging data provide a far more secure and efficient imaging service to the patient than the old analogue film system.