| DICOM PS3.15 2024c - Security and System Management Profiles |
|---|
When a DICOM File Set is sent over Email transport in compliance with this profile the following rules shall be followed:
The entire email (body, File Set attachment, and any other attachments) shall be encrypted using AES, in accordance with [RFC 3851] and [RFC 3853].
The email body and attachments may be compressed in accordance with [RFC 3851].
The email shall be digitally signed by the sender. The signing may be applied before or after encryption. This digital signature shall be interpreted to mean that the sender is attesting to his authorization to disclose the information in this email to the recipient.
The email signature is present to provide minimum sender information and to confirm the integrity of the email transmission (body contents, attachment, etc.). The email signature is separate from other signatures that may be present in DICOM reports and objects contained in the File set attached to the email. Those signatures are defined in terms of clinical uses. Any clinical content attestations shall be encoded as digital signatures in the DICOM SOP instances, not as the email signature. The email may be composed by someone who cannot make clinical attestations. Through the use of the email signature, the composer attests that he or she is authorized to transmit the data to the recipient.
This profile is separate from the underlying use of ZIP File or other File Set packaging over email.
Where private information is being conveyed, most country regulations require the use of encryption or equivalent protections. This Profile meets the most common requirements of regulations, but there may be additional local requirements. Additional requirements may include mandatory statements in the email body and prohibitions on contents of the email body to protect patient privacy.
| DICOM PS3.15 2024c - Security and System Management Profiles |
|---|