P.K. SHARMA
Cyber security intelligence, AI governance, practitioner analysis
Sector specialist
PACS, RIS and HIS estates I ran for eight years: DICOM and HL7 integration, migration off ageing archives, and securing imaging kit designed before anyone assumed it would be on a network.
DICOM was published in 1993 for a trusted, isolated network, and its defaults still assume one: services that answer to whoever reaches the port, authentication that is optional and usually unused. Then the estate was networked, given a web viewer and joined to a national record. Nothing here is a vulnerability in the usual sense: it is a protocol working exactly as designed, in an environment it was never designed for.
1993
DICOM first published
Designed for a trusted, isolated network. The defaults still assume one.
8
Years running this estate
PACS, DICOM, HL7, HIS and RIS in live clinical environments, 2010 to 2018.
2
HL7 generations, usually at once
v2 interfaces and FHIR running side by side. The older one holds the surprises.
3
Places identifiers hide in an export
Metadata, vendor private tags, and annotation burned into the pixels.
DICOM
Storage, Query/Retrieve, Modality Worklist, Storage Commitment. Association negotiation, called and calling AE titles, and whether anything actually verifies them.
HL7 v2 and FHIR
ADT feeds, order and result interfaces, and the integration engine in the middle. Most estates run both generations at once and the older one is where the surprises are.
IHE profiles
Scheduled Workflow, PIX and PDQ, XDS-I. The profiles are how you tell an integration problem from a configuration problem.
DSPT and NHS assurance
The Data Security and Protection Toolkit, and the evidence an imaging estate is expected to produce for it.
Network segmentation
The control that actually works here, because much of the estate cannot be patched on any schedule you control.
UK GDPR and de-identification
Pixel data is only half the problem. Burned-in annotation and the private tags are where identifiers survive an export that everyone believed was anonymous.
Modalities, archive, worklist, viewers, gateways and routing rules, including the interface somebody stood up for a research project in 2019 and never decommissioned. The documented architecture and the running one are rarely the same.
Every DICOM association and HL7 interface, in both directions, with the AE titles and endpoints that actually appear on the wire rather than the ones in the design document.
Separate what can be segmented this month, what needs a maintenance window, and what waits for a modality refresh. A recommendation that requires downtime you cannot take is not a recommendation.
Against real exports rather than the configuration. Burned-in annotation and private tags survive most pipelines that are believed to be safe.
Study integrity and prior availability as acceptance criteria, with a rollback that has been thought through before the first study moves.
Documentation and a control set your own team runs afterwards, not a report that needs the author present to be useful.
This is delivery experience rather than framework knowledge, which is the distinction that matters on this page: the estate described here is one I ran for eight years. What still belongs to you is clinical sign-off. Your Clinical Safety Officer owns the safety case and your information governance lead owns the disclosure decisions. What this brings is the ability to tell them precisely how the systems behave, which is usually the part nobody can answer.
Example scenario
An imaging estate believed to be isolated from the wider network.
The work: Traced every DICOM association and HL7 interface actually in use, rather than reading the architecture diagram.
The archive was reachable from general corporate network segments through a viewer gateway nobody had listed as an interface.
Example scenario
A research export described as fully anonymised.
The work: Inspected real exported studies rather than the de-identification configuration.
Pixel data was clean and the profile was correct. Burned-in annotation on one modality and a vendor private tag both carried identifiers straight through.
Example scenario
A trust planning to retire an ageing archive.
The work: Migration planning with prior availability as an explicit acceptance criterion.
The cutover plan had no defined position on what happens to a radiologist requesting a prior mid-migration, which is the failure mode that turns a migration into an incident.
Start the conversation
A question about this area, an invitation to speak, or a role you think fits: write, and you will get a straight answer.
Get in touchClinical imaging is the part of healthcare IT that generalist security consultants get wrong, because the constraints are not the ones they are used to.
DICOM was published in 1993 and designed for a trusted, isolated network. Its defaults reflect that: services that answer to anyone who can reach the port, authentication that is optional and frequently unused, and an association model where the reasonable assumption is that everything on the wire belongs there. Then the estate was connected to a wider network, given a web viewer, and joined to a national record.
Nothing about that is a vulnerability in the usual sense. It is a protocol working as designed, in an environment it was never designed for. The published research on exposed imaging archives, and the guidance the US Department of Health and Human Services has issued on PACS exposure, is what happens when that gap is left alone.
Meanwhile the clinical constraint is absolute. You cannot take the archive down for a weekend, you cannot break the modality worklist, and a radiologist who cannot pull a prior is a patient safety issue, not a service ticket.
Eight years running exactly this environment, from 2010 to 2018: PACS, DICOM, HL7, HIS and RIS implementation, vulnerability management and security audit across live clinical systems, and training clinical staff to operate them safely. The healthcare AI assurance practice grew out of it, which is why the questions here start with how the estate behaves rather than with a control framework.