PACS firewall rules for radiology: a practical guide

PACS firewall rules for radiology come down to one principle: block everything by default, then allow only the specific DICOM and viewer traffic between named device pairs. Place modalities, PACS servers, workstations and outside connections in separate network zones, and review the rules on a schedule. This guide shows how to build, test and maintain that rule set, and what to ask any outside reading partner about connectivity.

• A default-deny firewall between imaging zones is the core control described in the NIST SP 1800-24 practice guide (2020) for securing PACS.
• DICOM recommends port 104 where the operating system allows privileged ports, and port 11112 where it does not.
• IANA registers port 2762 for DICOM over TLS and port 11112 for standard DICOM.
• The HIPAA Security Rule requires an accurate risk analysis, access control, audit controls and transmission security for ePHI.
• AstraRad delivers final signed reports straight into a client's existing PACS, with no extra portal.
• Any DICOM listener reachable from the internet is a finding that needs immediate remediation.

TL;DR

• Segment modalities, PACS servers, clinical workstations and vendor access into separate zones, and block traffic between zones unless a rule allows it.
• Write rules per device pair and per port, never as wide subnet-to-subnet openings.
• Give outside readers and vendors a VPN or gateway with authentication and logging, not an open hole to a DICOM listener.
• Document, test and review rules on a schedule, because HIPAA expects safeguards to be revisited as risk changes.

Table of Contents

• What are PACS firewall rules, and why do radiology teams need them?
• Who is AstraRad, and why do we publish this guide?
• Which network zones does a radiology PACS environment need?
• Which ports and protocols does PACS traffic use?
• How should you restrict access between modalities, servers, workstations and outside networks?
• How do you secure remote access and third-party reading connections?
• How can AstraRad fit into your PACS network design?
• What do HIPAA and federal guidance require of PACS firewall configuration?
• Why is exposing PACS or DICOM services to the internet risky?
• How do you test and maintain PACS firewall rules without interrupting radiology?
• What should you ask a teleradiology partner about network connectivity?
• FAQ
• Sources

What are PACS firewall rules, and why do radiology teams need them?

PACS firewall rules are the allow and deny statements that decide which devices may talk to your picture archiving system, over which ports, and in which direction. Radiology needs them because imaging devices often run old software, store protected health information, and exchange data over protocols that were not designed with strong authentication.

Three terms keep the rest of this guide clear.

• A PACS is a picture archiving and communication system, the set of servers, storage and viewers that store, route and display medical images.
• DICOM is the Digital Imaging and Communications in Medicine standard, the format and network protocol that modalities and PACS use to exchange images and metadata.
• A firewall rule is a policy entry that permits or blocks traffic based on source, destination, port and protocol.

A flat network is the problem these rules solve. When a CT scanner, a PACS database, a front-desk PC and a vendor laptop share one subnet, a compromise of any one of them reaches all of them. The NIST National Cybersecurity Center of Excellence built a reference PACS architecture in its 2020 practice guide, SP 1800-24, around the idea of organizing the environment into zones and limiting communication to what each business function actually needs.

For buyers, firewall rules are also a procurement topic. Any contract that adds a reading partner, a cloud archive or a new modality adds network paths. Each path needs an owner, a documented rule and a review date.

Who is AstraRad, and why do we publish this guide?

AstraRad is a US teleradiology service that delivers final signed reports read by board-certified subspecialists. We have a commercial interest in this topic: hospitals, imaging centers and radiology groups that outsource reads need a network design that lets outside radiologists work without weakening the firewall. Our reports go straight into your existing PACS, DICOM conformant, with no extra portal for your staff to manage. You can review how that works on our How Teleradiology Works page, or browse our teleradiology services. The guidance below applies whether or not you ever work with us.

Which network zones does a radiology PACS environment need?

A radiology PACS environment needs at least four zones: modalities, PACS servers and storage, clinical workstations, and vendor or remote access. Each zone sits in its own VLAN behind a firewall, and no zone trusts another by default. The NIST SP 1800-24 guide describes VLAN-based zones that limit communication to the minimum necessary for business function.

A VLAN is a virtual local area network, a logical grouping of devices that behaves like a separate network even when it shares physical switches. VLANs alone do not enforce security. The firewall or a routing policy between VLANs does, so the rule set is where the protection lives.

Zone	What lives in it	Typical default stance
Modalities	CT, MR, X-ray, ultrasound, PET-CT, mammography units	Outbound to PACS only, no inbound from workstations except service tools you approve
PACS core	Archive, database, image router, VNA	Inbound from modalities and viewers on named ports only
Clinical workstations	Reading stations, viewers, reporting tools	Outbound to PACS and reporting systems, no direct modality access
Vendor and remote access	Manufacturer support, outside readers, maintenance tools	Terminated at a gateway, logged, time-limited
Management	Admin consoles, monitoring, backup	Restricted to named administrators

The UK's NHS England Digital network segmentation guidance (2025) reaches a similar conclusion for imaging: isolate components such as the archive and database in their own logical group, so a compromise of one segment does not take down a whole category of imaging devices. It is a British publication, so treat it as supporting design logic rather than a US requirement.

How granular should the zones be?

Start with the five zones above and split further where risk differs. Many sites separate legacy modalities that cannot be patched from newer devices, because those older units need tighter rules. Others separate a research or teaching PACS from the clinical one. Every extra zone adds rules to maintain, so split only where a different trust level justifies it.

Which ports and protocols does PACS traffic use?

PACS traffic mostly uses DICOM over TCP, and the port is configurable, which is why it differs between systems. The DICOM standard recommends port 104 when the operating system permits privileged ports and port 11112 when it does not. Never assume a port; confirm it on each application entity.

An application entity, or AE, is a DICOM endpoint identified by an AE title, an IP address and a port. Both ends of an exchange must be configured to know each other, which is what makes device-pair rules practical.

Port	Use	Source
104/TCP	DICOM where privileged ports are available	DICOM Standard, Part 8
11112/TCP	DICOM, the registered alternative	IANA registry
2762/TCP	DICOM over TLS	IANA registry
Site-specific	Web viewers, HL7 interfaces, vendor tools	Your PACS vendor's documentation

HL7 is a messaging standard that moves orders, results and patient demographics between clinical systems, and RIS and EHR interfaces usually run on ports your integration team chose. Web viewers typically use standard HTTPS. Because these ports vary by installation, build your rule table from a discovered inventory: capture which AE titles talk to which, then write rules that match observed, approved flows.

What changes when you add encryption?

Plain DICOM is not encrypted by itself. DICOM over TLS uses the registered TLS port and protects images in transit, but both ends must support it and hold valid certificates. If you adopt it, write separate rules for the TLS port and retire the plain rule once every peer has moved.

How should you restrict access between modalities, servers, workstations and outside networks?

Restrict access by writing one rule per source, destination and port, then denying everything else. A modality may send to the PACS on its DICOM port, a workstation may query the PACS, and neither may reach the other. Wide openings between subnets defeat the purpose of segmentation, so avoid them even when they are faster to configure.

The NHS England guidance suggests placing modalities behind a router or firewall, isolating PACS workstations and viewers in dedicated zones, and giving external workstations access through virtual desktop sessions or equivalent remote access servers rather than direct connections. A virtual desktop infrastructure session, or VDI, is a remote desktop that runs inside your network, so images never leave your environment. It also advises that a dedicated firewall for a modality can act as that device's default gateway, so every packet is governed by policy.

Here is an illustrative rule matrix. The names are placeholders, and the ports must come from your own inventory.

Rule	Source	Destination	Port	Action
1	CT scanner A	PACS image router	DICOM port for that AE	Allow
2	Reading workstation group	PACS server	Viewer and query ports	Allow
3	PACS server	Reporting or RIS interface	Interface port	Allow
4	Vendor gateway	Named modality service port	Per support contract, time-limited	Allow, logged
5	Any	Any	Any	Deny and log

Two habits keep the matrix honest. First, give each rule an owner and a ticket reference, so an auditor can see why it exists. Second, set an expiry on every temporary rule, especially vendor maintenance windows.

What about legacy modalities that cannot be patched?

Some imaging devices run operating systems that no longer receive updates. HHS says in its Fall 2021 OCR Cybersecurity Newsletter that compensating controls for legacy systems may include aggressive firewall rules and restricting access to fewer users. It also advises making sure those systems are backed up, since new rules can disrupt earlier backup routines. Put the legacy device in its own zone, allow only its single send path, and confirm the backup still works after the change.

How do you secure remote access and third-party reading connections?

Secure remote access by terminating every outside connection at a VPN or dedicated gateway that requires authentication and logs sessions, rather than opening firewall holes directly to DICOM listeners. A VPN is an encrypted tunnel that places the remote user or system on a controlled path into your network. The same applies to teleradiology, cloud archives and manufacturer support.

Teleradiology is the remote interpretation of medical images by radiologists at another location. When you contract a reading partner, you create a path for images to leave and reports to return. Design that path deliberately.

1. Decide the data flow. Images can be pushed to the reader's platform, or the reader can view them through a session on your side. Each model needs different rules.
2. Allow only the named endpoints. Permit the partner's documented addresses and ports, not a broad range.
3. Authenticate and log. Require named accounts or certificate-based peers, and keep logs that your security team reviews.
4. Return reports through your PACS. Final signed reports should land where your clinicians already work, so you do not add a separate portal to secure and train staff on.
5. Put it in the contract. The business associate agreement, the SLA and the network design should reference each other.

Which contract terms belong beside the firewall design?

A BAA, or business associate agreement, is a contract required under HIPAA when a vendor handles protected health information for you. AstraRad works as a business associate under a signed BAA and is HIPAA aligned. A coverage plan with SLA terms in writing follows our discovery call, so the turnaround commitments and the connection design sit in the same documentation. Credentialing and state licensure are separate workstreams, but your network team should know the partner's addresses before go-live.

How can AstraRad fit into your PACS network design?

AstraRad is a US teleradiology service that delivers final signed reports read by board-certified subspecialists. Studies are matched to a subspecialist by modality and body part, across ten subspecialties and twelve study types, on scheduled US shifts 24/7/365, with every read performed inside the United States. Reports return to your existing PACS, so your firewall change list stays short and your radiologists keep one worklist.

Turnaround is committed by contract and measured from last-image arrival to radiologist signature: STAT under 4 hours, routine 24 to 48 hours, and stroke protocol under 30 minutes. Pricing is per report with no minimums, and the first signed report arrives within 10 business days of countersignature. If you want to see where a reading partner would sit in your architecture, start with our teleradiology services, then look at coverage for your setting, such as rural and critical access hospitals or weekend and holiday coverage.

To scope a connection, book a discovery call from our landing page. Your network team can bring its zone diagram and we will talk through how reads and reports would flow.

What do HIPAA and federal guidance require of PACS firewall configuration?

HIPAA does not prescribe specific firewall rules. It requires covered entities and business associates to perform an accurate risk analysis and apply reasonable and appropriate safeguards, including access control, audit controls, authentication and transmission security. Your firewall rule set is evidence that you applied those safeguards to the systems holding imaging ePHI.

The HHS summary of the HIPAA Security Rule describes the risk analysis as an accurate and thorough assessment of potential risks and vulnerabilities to ePHI, followed by risk management using reasonable and appropriate measures. A practical way to map that to PACS is a simple table.

Security Rule theme	PACS firewall evidence
Risk analysis	Inventory of AE titles, zones and data flows, with identified exposures
Access control	Device-pair rules, role-limited vendor and remote access
Audit controls	Firewall and gateway logs retained and reviewed
Authentication	Named VPN accounts or certificate-based peers
Transmission security	TLS for DICOM where supported, VPN tunnels for outside paths

The rule also expects safeguards to be reviewed. Treat each modality install, PACS upgrade, vendor change and new reading contract as a trigger to revisit the risk analysis and the rules. Ask your compliance officer and counsel how your organization documents those reviews, since the details depend on your entity type and state requirements.

Why is exposing PACS or DICOM services to the internet risky?

Exposing DICOM services to the internet lets any system that can reach the listener attempt to send or query images, and DICOM was not built around internet-grade authentication. CISA advises minimizing network exposure so that control systems are not reachable from the internet and sit behind firewalls, in its advisory on OHIF Viewers (2026).

In practice, treat these as findings:

• A C-STORE listener, which accepts images, reachable from outside the imaging VLAN.
• A C-FIND listener, which answers queries about patient studies, reachable from outside the imaging VLAN.
• A web viewer published directly without a gateway, authentication and logging.
• A vendor remote tool left permanently enabled.

A C-STORE is the DICOM operation that sends an image to a receiving system, and a C-FIND is the operation that queries a system for matching studies. Both belong inside segmented zones. Run an external scan of your public address space on a schedule and compare it to your inventory, so you find forgotten port forwards before someone else does.

How do you test and maintain PACS firewall rules without interrupting radiology?

Test and maintain rules by staging changes, validating them against real DICOM traffic, and keeping a rollback ready. Schedule changes outside peak reading hours, confirm that each modality can still send, and monitor for blocked flows afterward. NIST SP 1800-24 also recommends behavioral analytics and intrusion detection to spot anomalous activity inside PACS segments.

The NIST guide notes that safeguards, including firewall rules, must be periodically evaluated and modified as the risk environment changes. A repeatable routine looks like this:

1. Baseline. Record current flows by AE title, port and direction before touching anything.
2. Stage. Build the new rule in log-only or monitor mode where your firewall supports it.
3. Validate. Send a test study from each modality type, query from a workstation, and push a report back from the reading system.
4. Cut over. Apply during a low-volume window with a named engineer and a radiology contact on call.
5. Verify. Check that studies arrive, queues are empty and backups still run.
6. Review. Expire temporary rules, remove unused ones, and re-certify the owner of every remaining rule on a fixed cycle.

Keep a downtime procedure for radiology too. If a rule change blocks a modality, technologists should know how to hold studies locally and who to call.

What should you ask a teleradiology partner about network connectivity?

Ask any teleradiology partner for a written description of how images leave, how reports return, which endpoints must be allowed, and who is accountable for each. A vendor that cannot describe its data flow in a form your network team can turn into rules is a risk before the first study is read.

Question	What a clear answer includes
How do reports reach our PACS?	Delivery into the existing PACS, DICOM conformance stated, no separate portal
Which endpoints and ports must we allow?	A documented list your team can write as rules
How are outside connections authenticated and logged?	VPN or gateway model, named accounts, log access
What is the BAA position?	A signed BAA and HIPAA aligned safeguards, in writing
Where are reads performed?	Location of every read, such as inside the United States
How are turnaround times committed?	SLA terms in writing, measured from last-image arrival to signature
What are the commercial terms?	Per-report pricing, minimums or none, extra platform fees or none

Our own answers on reads, reports and commercial terms are in the section above. For modality-specific details, see our MRI teleradiology reporting and X-ray and ultrasound overflow reads pages.

FAQ

What firewall ports does a PACS need open?

A PACS needs the DICOM port configured on each application entity, commonly 104 or 11112, plus 2762 if you use DICOM over TLS. It also needs whatever your viewers and HL7 interfaces use. Open only those ports between named device pairs, and confirm each from your vendor documentation rather than assuming defaults.

Does HIPAA require a firewall for PACS?

HIPAA does not name a firewall, but it requires a risk analysis and reasonable, appropriate safeguards for ePHI, including access control and transmission security. For imaging systems, a segmented, default-deny firewall is a common way to meet those expectations. Confirm your documentation approach with your compliance officer.

Should a PACS ever be reachable from the internet?

No DICOM listener should be directly reachable from the internet. CISA advises keeping such systems behind firewalls and out of direct internet exposure. Provide outside access through a VPN, gateway or virtual desktop session with authentication and logging, and scan your public address space regularly for forgotten exposures.

How often should PACS firewall rules be reviewed?

Review them on a fixed schedule set in your policy, and again after any modality install, PACS upgrade, vendor change or new reading contract. NIST guidance says safeguards must be periodically evaluated and modified as risk changes. Remove expired temporary rules at each review.

How does a teleradiology service connect to our PACS without new firewall exposure?

The design should return final signed reports to your existing PACS and limit outside paths to documented endpoints with authentication and logging. AstraRad delivers reports directly into the client's PACS with no extra portal. Your network team should still review the exact flow during onboarding.

Sources

• NIST NCCoE SP 1800-24: Securing Picture Archiving and Communication Systems (2020)
• NHS England Digital: Patterns for imaging diagnostic components (2025)
• DICOM Standard Part 8: DICOM Upper Layer Protocol for TCP/IP
• IANA Service Name and Transport Protocol Port Number Registry
• HHS: Summary of the HIPAA Security Rule
• HHS OCR Cybersecurity Newsletter, Fall 2021
• CISA ICS Medical Advisory: OHIF Viewers DICOM (2026)