How to share an MRI or CT scan securely

Someone finishes an MRI or a CT scan, and almost immediately a second question follows the first: who else needs to see this, and how do I get it to them?

It might be a referring physician who ordered the exam, a specialist the patient is being sent to, a surgeon planning a procedure, a radiologist providing a second opinion, or the patient themselves, who has every right to a copy of their own images. In each case the study has to travel safely from where it was acquired to wherever it is needed next.

For years the default answer was a disc. Today there are faster, safer, and more practical ways to share an MRI or CT scan, and the difference matters because these are not ordinary files. They are protected health information, and how you move them is as important as the fact that you moved them at all.

This guide walks through why sharing matters, why the old disc-based workflow has aged badly, the secure ways to share an MRI or CT today, and how to keep the whole process HIPAA-conscious for patients, referrers, and specialists alike.

Why sharing imaging matters

An MRI or CT scan is rarely useful in isolation. Its value comes from the people who act on it, and most of those people are not in the room where the scan was taken.

Sharing imaging well supports several everyday situations:

Referrals. When a patient is referred onward, the receiving provider needs the actual images, not just a written report, to plan the next step in care.
Second opinions. A patient seeking another perspective should be able to send the full study to another radiologist or physician without re-imaging.
Specialist care. A surgeon, oncologist, or neurologist often wants to review the study before the appointment so the visit can be productive from the start.
Patient access. Patients have a right to their own imaging, whether for personal records, a move to a new provider, or coordinating their own care.

When sharing is slow or unreliable, every one of these situations suffers. Appointments get rescheduled, scans get repeated unnecessarily, and patients end up acting as couriers for their own medical records. When sharing works well, care moves faster and the practice becomes easier to work with.

The old way: burning a CD or DVD

For a long time, “sharing” an MRI or CT meant burning the study to a CD or DVD and handing it over. It was the standard, and in many places it still lingers. But the disc workflow carries problems that have only grown over time.

No disc drives. Most modern laptops and many desktops no longer have an optical drive at all. A patient or provider can be handed a disc they simply cannot open.
Discs fail and get lost. They scratch, crack, and degrade. They get left in a drawer, lost in the mail, or forgotten on the day of the appointment.
It is slow. Burning, labeling, and physically transporting a disc takes time. If the patient has to drive it across town, the delay can stall care for days.
It is hard for patients. Even when a disc opens, it often contains a clunky bundled viewer or raw DICOM files the recipient does not know how to read.

None of this means physical media is forbidden. Some situations still call for it. But as a default workflow, the disc has been overtaken by approaches that are faster, more reliable, and easier on everyone involved. Our guide to modernizing imaging workflow at a small practice looks at how to phase discs out without disruption.

The secure ways to share imaging today

There is no single “right” way to share an MRI or CT scan. The best method depends on who the recipient is and what they need to do with the study. Three approaches cover the vast majority of cases.

An encrypted, expiring share link

The most flexible modern option is a secure link to the study. Instead of moving a file, you share controlled access to it: the recipient opens the link, confirms their identity through whatever access control you have set, and views the full study in a browser.

A well-designed share link is encrypted in transit, can be set to expire after a period of time, and can be revoked if it is no longer needed. That combination keeps sharing intentional. The link goes to a specific person for a specific purpose, and access does not linger indefinitely once the need has passed. This works equally well for patients, referrers, and specialists, which is part of why it has become the default for so many practices.

A patient portal

For patients specifically, a portal is often the cleanest path. The patient logs in or enters an access code, sees their own studies, and can view or share them without calling the office repeatedly. A good portal also lets patients upload prior imaging they bring from elsewhere, which helps your practice gather outside studies in an organized way rather than collecting a stack of discs.

The key is that a portal puts patients in control of their own images while keeping access tied to identity. We cover what a portal needs to do in more detail in our guide to HIPAA-compliant image sharing.

PACS-to-PACS transfer

When two organizations both run imaging systems, the studies can often move directly from one PACS to another. This is the most seamless option for ongoing relationships, because the study lands directly in the receiving system’s workflow with no manual download, upload, or file handling in between. PACS-to-PACS transfer is well suited to high-volume referral relationships and to networks of facilities that routinely send studies back and forth.

What to check so sharing stays HIPAA-conscious

An MRI or CT scan is protected health information, so the way you share it has to respect that. No single tool makes a practice compliant on its own, and nothing here is legal advice, but a few practical checkpoints help keep any sharing workflow on solid ground.

Access control. The study should reach a specific, identified recipient, not anyone who happens to find a link. Access should be granted deliberately, not left open to the public.
Expiring and revocable links. Sharing should not be permanent by default. The ability to set an expiration and to revoke access afterward keeps exposure limited to the window when it is actually needed.
An audit trail. You should be able to see what was shared, with whom, and when. A record of access matters both for accountability and for understanding what happened if a question ever arises.
Minimum necessary. Share the study the recipient needs, not your entire archive. Scoping access to the specific exam keeps sharing proportionate to the purpose.

The common thread is intent. Secure sharing is about making the right study available to the right person for the right reason, then closing the door again. A workflow that does that quietly and consistently is far safer than one that depends on staff remembering to be careful every single time.

How sharing differs by recipient

The same study often needs to reach very different people, and what counts as a good experience changes with each one.

Patients

Patients should not have to understand DICOM, PACS, or viewers to see their own scan. The experience needs to be simple enough that someone who is stressed, preparing for surgery, or coordinating care across providers can follow it without calling the office three times. A portal or a plain share link that opens in a browser usually fits best, because there is nothing to install and nothing to decode.

Referring providers

A referring physician wants the images quickly and with as little friction as possible. The easier you make it for them to open a study, the easier your practice is to refer to. A secure link or a PACS-to-PACS transfer keeps the study in their workflow without forcing them to chase down a disc or wait on the mail.

Specialists

A specialist or surgeon often needs to review the study before the patient ever arrives, and they may need to scroll the full series, adjust the window and level, and take measurements. That means they need the actual study, not a flattened picture of it. Sharing the full-fidelity DICOM through a viewer lets them do real diagnostic work rather than squinting at a screenshot.

What not to do

Some shortcuts feel convenient but quietly create risk or destroy the very thing you are trying to share.

Do not email raw files. Ordinary email is not built for protected health information, and large DICOM studies tend to be too big to attach anyway. An uncontrolled attachment cannot be revoked once it has been sent, and you lose any record of where it ended up.
Do not convert the study to JPEG to make it easier to send. Flattening a CT or MRI into JPEGs throws away the metadata, the full grayscale range, the adjustable window-level, and the slice-by-slice structure that make the study diagnostically useful. It can also expose burned-in patient identifiers baked into the pixels. A converted image is fine for a single illustration, but it is not a way to share a study someone needs to interpret. Our guide on converting DICOM to JPEG goes deeper on the trade-offs.
Do not rely on generic consumer file-sharing tools. Services built for vacation photos are not designed around the access control, expiration, and auditability that medical imaging calls for.

The pattern across all three is the same: avoid anything that strips fidelity or sends data somewhere you can no longer see or control.

How FreedomPACS handles secure sharing

FreedomPACS is built so that sharing an MRI or CT scan does not mean leaving the safety of your imaging system behind.

Image Share lets a provider share a study through a patient portal using an access code, so the right person gets access to the right exam without a disc changing hands. It also lets patients upload prior imaging to share with their provider, which makes gathering outside studies far more orderly than collecting a pile of CDs.

When the recipient opens what was shared, they do not get a download to wrestle with. They open the full study in the browser-based Online Viewer and see the real images, with the ability to scroll the series and review the study as it was acquired. Patients, referrers, and specialists all open the same study the same way, with nothing to install.

Because sharing is connected to the larger platform, the study lives in your PACS and is shared from there rather than copied around. FreedomPACS Cloud adds the convenience of cloud access, so studies can be reached and shared from wherever care actually happens, not only from the room where the scan was taken.

Bringing it together

Sharing an MRI or CT scan does not have to mean burning a disc and hoping it arrives. The modern toolkit is straightforward: an encrypted, expiring link for flexible one-to-one sharing, a patient portal for giving patients control of their own images, and PACS-to-PACS transfer for ongoing referral relationships.

Whichever you reach for, the principles stay the same. Keep access controlled, time-limited, and recorded. Share only the study that is needed. Send the full-fidelity images rather than a degraded copy. And match the experience to the recipient, so patients get something simple while specialists get something they can actually work with.

Get those pieces right and sharing becomes one of the easiest parts of imaging instead of one of the most frustrating. The goal is the one it has always been: give the right person access to the right study at the right time, while keeping patient information protected the whole way through.