Ein Lösungsweg, um medizinische Bilder mit digitalen Signaturen nach dem DICOM-Standard zu versehen: Embedded Systems

Security of patient and study data associated with DICOM images when transferred using compact disc media

The transmission of patient and imaging data between imaging centers and other interested individuals is increasingly achieved by means of compact disc digital media (CD). These CDs typically contain, in addition to the patient images, a DICOM reader and information about the origin of the data. While equipment manufacturers attach disclaimers to these discs and specify the intended use of such media, they are often the only practical means of transmitting data for small medical, dental, or veterinary medical centers. Images transmitted by these means are used for clinical diagnosis. This has lead to a heavy reliance on the integrity of the data. This report describes attempts to alter significant patient and study data on CD media and their outcome. The results show that data files are extremely vulnerable to alteration, and alterations are not detectable without detailed analysis of file structure. No alterations to the DICOM readers were required to achieve this; changes were applied only to the data files. CDs with altered data can be readily prepared, and from the point of view of individuals viewing the images, function identically to the original manufacturer's CD. Such media should be considered unsafe where there is a potential for financial or other gain to be had from altering the data, and the copy cannot be cross-checked with the original data.

The Public-Key-Infrastructure of the Radiological Society of Germany

Pretty Good Privacy (PGP) encoding is based on the Public-Key-Procedure and permits the safe transmission of medical data. Furthermore it allows the use of an electronic signature provided that keys used belong to the key owner and that the key owner's identity is guaranteed by a trusted third party. Under the auspices of the Radiological Society of Germany (Deutsche Röntgengesellschaft, DRG) its IT-Working Group (Arbeitsgemeinschaft für Informationstechnik, @GIT) built up an appropriate Certification Authority including the required Public-Key-Infrastructure. These @GIT certified PGP keys allow the legal use of telemedicine in Germany. Digital signatures based to those certified keys correspond to the advanced signature according to the German Signature Law.

[Current developments in DICOM and IHE]

The broadening use of imaging management systems in radiology and other disciplines is due in large part to the success of the DICOM standard (Digital Imaging and Communications in Medicine), which has been accepted worldwide for more than 10 years and meanwhile represents one of the most successful standards in medicine. The central intent of establishing the initiative "Integrating the Healthcare Enterprise" (IHE) was to ensure interoperability of different IT systems in medical processes. IHE is essentially based on widespread standards such as DICOM or HL7. This overview article briefly addresses the principles and organization of DICOM and IHE and describes the current developments in both domains.