Fact-checked by Grok 2 weeks ago

DICOMweb

DICOMweb is a set of RESTful web services defined in Part 18 (PS3.18) of the standard, enabling the query, retrieval, storage, and management of data over the web using HTTP protocols and formats such as and XML. Introduced in 2013 as the second generation of DICOM web services, it builds on earlier efforts like the 2003 Web Access to DICOM Objects (WADO) specification to provide a modern, developer-friendly interface for integrating DICOM objects into web-based applications without requiring proprietary DICOM software. The core services of DICOMweb include Query based on ID for DICOM Objects (QIDO-RS) for searching studies, series, and instances by identifiers like patient ID; Web Access to DICOM Objects using Retrieve (WADO-RS and WADO-URI) for fetching specific DICOM data; Store Over the Web (STOW-RS) for uploading instances; and Unified Procedure Step (UPS-RS) for workflow management, along with a Capabilities service to discover supported endpoints. These services operate on resources representing DICOM hierarchies—such as studies, series, and instances—and support multipart types for efficient transfer of data alongside . By leveraging standard technologies, DICOMweb facilitates in healthcare IT systems, of imaging data, and integration with electronic health records, addressing challenges in sharing large volumes of medical images across distributed environments. Since its release, DICOMweb has evolved through supplements and change proposals, with the current version (2025d) incorporating enhancements like services and improved handling, while maintaining backward compatibility with the original 2013 APIs such as QIDO-RS, WADO-RS, and STOW-RS. Its adoption has grown in telemedicine, AI-driven image analysis, and vendor-neutral archiving, promoting a shift from traditional DICOM DIMSE protocols to web-centric architectures that enhance accessibility for global healthcare providers.

Overview

Definition and Purpose

DICOMweb is a family of RESTful web services defined within the and Communications in Medicine () standard, designed to enable the sending, retrieving, and querying of medical images and associated information over HTTP and protocols. It extends the core DICOM information model—originally developed for network and media-based interchange—to web environments, allowing seamless interaction between user agents (such as web browsers or applications) and origin servers to manage DICOM resources like studies, series, and instances. This web-native approach leverages standard HTTP methods and media types, supporting metadata encoding in formats such as and XML to represent DICOM data sets without altering the underlying DICOM semantics. The primary purpose of DICOMweb is to provide interoperable access to DICOM data for diverse healthcare applications, eliminating the need for specialized DICOM protocols like DIMSE while utilizing familiar web technologies. By acting as a bridge between legacy DICOM systems and modern web infrastructures, it facilitates efficient data exchange in environments such as Picture Archiving and Communication Systems (PACS), Electronic Health Records (EHRs), and radiology information systems (RIS), promoting standardized workflows without requiring modifications to image-producing modalities. This design ensures that developers can integrate medical imaging capabilities using industry-standard tools, enhancing accessibility for both clinical and non-clinical users. In modern healthcare, DICOMweb plays a crucial role in advancing cloud integration, portals, and AI-driven by enabling secure, scalable sharing of imaging data across devices and institutions. It supports -centered care models through web-based retrieval and querying, allowing authorized access to images in EHRs and mobile tools, while fostering collaborative use in telemedicine and research applications. Overall, DICOMweb addresses the limitations of traditional by aligning with the broader ecosystem, thereby improving and efficiency in an increasingly healthcare landscape.

Architecture and Technologies

DICOMweb employs a RESTful architecture, which defines a set of constraints for designing networked applications, emphasizing stateless client-server communication, uniform interfaces, and the use of standard HTTP methods to perform operations on resources identified by Uniform Resource Identifiers (URIs). This design ensures that each request from a client to a server contains all necessary information for processing, without reliance on prior interactions, thereby promoting scalability and simplicity in systems. The architecture leverages , , , and protocols for transport, with recommended for secure transmission of sensitive over the . At its core, DICOMweb utilizes as the primary format for encoding , defined in Appendix F of PS3.18, which maps data elements to JSON structures using the media type application/dicom+json and encoding. For handling binary payloads such as DICOM instances or image data, the architecture supports the multipart/related MIME type as specified in RFC 2387, allowing a single HTTP request to bundle metadata and bulk data parts efficiently. This combination enables seamless transfer of complex DICOM objects while adhering to web conventions. The resource model in DICOMweb organizes data hierarchically through URI paths, representing studies, series, and instances as addressable entities—for example, /studies/{studyUID} for a study resource or /studies/{studyUID}/series/{seriesUID}/instances/{instanceUID} for a specific instance. These s follow URI template syntax from RFC 6570, ensuring precise identification without proprietary extensions. By integrating directly with established web standards, including HTTP headers like Accept and Content-Type, DICOMweb facilitates compatibility with browsers, standard APIs, and development tools, eliminating the need for custom protocols.

Standards

PS3.18: Web Services

PS3.18 of the standard defines the normative specifications for web services that enable the management and distribution of objects using RESTful principles over the HTTP/HTTPS family of protocols. These services facilitate interactions such as querying, retrieving, and storing data in a web-accessible manner, supporting resource-oriented architectures where instances, studies, and series are treated as addressable resources. is provided through the Retrieve Capabilities , accessible via a dedicated that returns an XML or document detailing the available services, supported operations, and conformance levels of the DICOMweb implementation. Chapter 8 of PS3.18 provides an overview of the common aspects applicable to all DICOMweb services, including transaction models, media types, and general requirements for requests and responses. Chapter 10 specifies the core retrieval and storage services: QIDO-RS (Query/Retrieve Information for Display - RESTful Service) for searching and retrieving metadata of DICOM objects using query parameters; WADO-RS (Web Access to DICOM Objects - RESTful Service) for accessing rendered images, bulk data, or metadata from studies, series, or instances; and STOW-RS (STOre Over the Web - RESTful Service) for uploading DICOM objects via multipart payloads. Chapter 11 details UPS-RS (Unified Procedure Step - RESTful Service), which manages workflow resources for procedure steps, including creation, subscription, and event reporting to coordinate multi-system interactions. The specifications outline URI structures using standardized templates to identify resources, such as /studies/{[study](/page/Study)} for study-level access, with path parameters and query strings for filtering and pagination. HTTP methods (GET, , etc.) are mandated for specific operations, with responses using standard status codes like 200 OK for success, Bad Request for malformed inputs, and Not Found for missing resources, as detailed in Table 8.5-1. Error handling requires detailed status reports in failure responses, including failure reasons and codes to aid and . Conformance requirements in Section 6 mandate support for specific IANA-registered media types, secure transport, and optional features like multipart responses, ensuring across implementations. Notable updates include the 2017 addition of resources via Supplement 203, which introduced representations retrievable by appending /thumbnail to resource URIs, enabling efficient previews without full data transfer. In 2025, Change Proposal CP-2473 clarified HTTP response codes for search transactions returning zero results, aligning them more closely with HTTP semantics to improve in edge cases.

PS3.19: XML Encoding

PS3.19 specifies the XML encoding rules for representing data structures in a format suitable for web-based services and application hosting, focusing on the Native DICOM Model defined in Appendix A.1. This model provides a direct mapping of binary-encoded DICOM Service-Object Pair (SOP) Instances to XML Infosets, enabling navigation and manipulation using standard XML tools without requiring specialized DICOM binary parsing libraries. The purpose is to facilitate in environments where XML processing is preferred, such as in hosted applications or RESTful web services, by defining precise representations for DICOM datasets, metadata, data elements, attributes, and sequences. Key features of the XML encoding include the hierarchical structure of the Native DICOM Model, which uses elements like <NativeDicomModel>, <DicomDataSet>, and <DicomAttribute> to mirror DICOM's organization. Data elements are encoded as <DicomAttribute> with attributes such as tag (e.g., "00100020" for Patient ID), optional vr (Value Representation, e.g., "LO"), keyword (from PS3.6 definitions), and privateCreator for private attributes. Values are captured in <Value> elements with a number attribute to preserve multiplicity and order, supporting multi-valued attributes like those in sequences. Sequences are represented recursively with <Item> elements containing nested <DicomAttribute> structures, while bulk data references use <BulkData> with URI or UUID pointers, and inline binaries are base64-encoded in <InlineBinary>. Person names (PN VR) are further structured with sub-elements for alphabetic, ideographic, and phonetic components. This mapping supports full DICOM datasets and metadata extraction, with padding for even byte lengths preserved where applicable. The encoding includes validation schemas in Relax NG Compact format (detailed in A.1.6), which enforce structure but perform minimal type checking to ensure bi-directional fidelity between XML and binary . Usage in DICOMweb services positions XML as an alternative to for responses in Query/Retrieve services like QIDO-RS (for search results) and WADO-RS (for instance ), with the media type application/dicom+xml. For example, a QIDO-RS response might return in Native DICOM Model XML, allowing queries such as /NativeDicomModel/DicomDataSet/DicomAttribute[@tag="00100020"]/Value[@number="1"] to extract specific values. Schemas enable rigorous validation of these representations, promoting consistency across implementations. Compared to encoding (defined in PS3.18), XML is more verbose due to explicit element tagging and nesting but offers greater schema rigidity for validation and tool interoperability. While uses lightweight key-value pairs, XML's Infoset allows unordered elements and supports advanced features like namespaces, though no serialization is mandated. Integration with the deprecated WADO-WS ( Services for , retired in PS3.18 Appendix C) previously leveraged XML but is no longer recommended, with Native Model XML now primarily used in modern RESTful contexts like STOW-RS for storage. Notable updates include Supplement 251 (March 2025), which introduces an updated RESTful (API) for PS3.19 Application Hosting and retires the previous SOAP-based API.
xml
<NativeDicomModel>
  <DicomDataSet>
    <DicomAttribute tag="00100020" vr="LO" keyword="PatientID">
      <Value number="1">12345</Value>
    </DicomAttribute>
    <DicomAttribute tag="00100010" vr="PN" keyword="PatientName">
      <PersonName>
        <Alphabetic>
          <Value number="1">Doe^John</Value>
        </Alphabetic>
      </PersonName>
    </DicomAttribute>
  </DicomDataSet>
</NativeDicomModel>
This example illustrates a simple dataset with Patient ID and Name attributes.

Services

Retrieval Services

DICOMweb retrieval services enable the access and download of objects and related data over HTTP/, primarily through two mechanisms: the RESTful Web Access to Objects using Retrieve (WADO-RS) and the URI-based Web Access to Objects (WADO-URI). These services support fetching studies, series, instances, , and rendered formats without requiring prior knowledge of the full protocol, facilitating integration with web-based applications. WADO-RS, defined in Section 10.4 of PS3.18, provides a RESTful interface for comprehensive retrieval using HTTP GET requests on resource-specific endpoints such as /studies, /series, and /instances. It supports retrieval of entire studies or series, individual instances, specific frames from multi-frame objects via paths like /frames/{framelist} or the frameNumber parameter, bulk data items, pixel data URIs, thumbnails, and advanced rendered outputs including multi-planar reformatting (MPR) and 3D volumes. Key parameters include accept for , charset for encoding, annotation for display overlays, quality for compression levels in rendered images, and viewport/window for adjusting image presentation. Responses can be in native format (application/dicom), multipart/related for bulk transfers, metadata (application/dicom+json), octet-stream for pixel data, or various image/video formats like image/jpeg or video/mp4 for rendered content. In contrast, WADO-URI, outlined in Chapter 9 of PS3.18, offers a simpler, legacy-oriented approach for retrieving single Composite SOP Instances or rendered s via HTTP GET with query parameters appended to a base . Mandatory parameters include requestType=WADO, studyUID, seriesUID, and objectUID to specify the target, while optional ones like frameNumber enable access to specific frames in multi-frame instances, and transferSyntax allows selection of encoding. It does not support bulk retrieval of multiple objects but is suitable for direct, lightweight access. Response formats include application/ for raw data or / for rendered views, often used in scenarios requiring anonymization or annotation via parameters like anonymize or annotation. Both services emphasize secure, stateless retrieval operations, with WADO-RS providing greater scalability for modern systems through its RESTful design and support for partial or aggregated responses. Common use cases include loading images into web-based viewers for clinical review, exporting pixel data or metadata to non-DICOM analysis tools, and generating thumbnails or rendered previews for user interfaces. For instance, a might use WADO-RS to fetch a series of frames for interactive visualization, while WADO-URI suits embedding a single annotated image in a .
FeatureWADO-RS (Section 10.4)WADO-URI (Chapter 9)
Primary UseRESTful access to studies, series, instances, frames, bulk data, rendered/3D outputsURI-based access to single instances or rendered images
Bulk/Frame SupportYes (multipart responses, /frames path, frameNumber param)Frames only (frameNumber param); no bulk
Key Parametersaccept, frameNumber, viewport, window, qualitystudyUID, seriesUID, objectUID, frameNumber, transferSyntax
Response FormatsDICOM, JSON metadata, octet-stream, image/video variantsDICOM, image/jpeg/png

Query Services

Query Services in DICOMweb primarily revolve around the QIDO-RS (Query based on ID for DICOM Objects) transaction, which enables RESTful searching of DICOM repositories for studies, series, and instances using HTTP GET requests. This service allows clients to discover and list DICOM objects based on specific identifiers and attributes, such as Patient ID, Study Instance UID, or Series Instance UID, without retrieving the full objects or pixel data. It supports hierarchical queries at the study, series, or instance level, facilitating efficient metadata retrieval for applications that need to index or preview imaging data. Key query parameters enhance the flexibility of QIDO-RS searches. The includefield parameter specifies which DICOM attributes (identified by tags like "00080005" for Specific Character Set) should be returned in the response, allowing customization to reduce payload size. The limit parameter restricts the number of results (e.g., to 10 matches), supporting pagination for large datasets. Additionally, the timezone parameter adjusts date and time attributes to a specified offset, such as UTC, ensuring consistency across global systems. QIDO-RS also accommodates fuzzy semantic matching for person names via the fuzzymatching=true parameter and partial matching using wildcards like '*', as well as relational queries at different hierarchy levels, and multiple attribute-value pairs combined implicitly with AND for more precise filtering. Responses from QIDO-RS are formatted in JSON or XML, providing structured lists of matching resources with their , such as unique identifiers and selected attributes. These responses exclude bulk data like elements, focusing instead on lightweight summaries that enable quick processing. Common use cases include generating patient worklists in clinical applications or creating previews of available studies without the overhead of full data retrieval, thereby improving performance in web-based imaging workflows. For instance, a query might search for all studies matching a Patient ID to build a view, leveraging the service's support for optional attributes and flexible matching rules.

Storage Services

The Storage Services in DICOMweb are primarily provided by the STOW-RS (Store Over the Web - RESTful Services) transaction, which enables clients to upload and store DICOM objects such as studies, series, and instances to a using HTTP requests. Defined in DICOM PS3.18 Section 10.5, STOW-RS targets resources like /studies for payloads containing instances from multiple studies or /studies/{study} for instances within a single study, with the request payload formatted according to specified media types for DICOM resources. This service supports storing complete DICOM instances in binary form or separated metadata (encoded in XML per PS3.19 or per Annex F) and bulkdata (e.g., as application/octet-stream for uncompressed items). Upon receiving a STOW-RS request, the origin validates the payload for conformance to the defined media types and checks elements such as Study Instance consistency, supported Classes, and Transfer Syntaxes. If validation passes, the stores the instances and may perform attribute , such as modifying or discarding non-conforming data elements, while generating necessary File Meta Information for the datasets. Bulk storage is facilitated by allowing multiple instances in a single request, optimizing uploads for efficiency in handling large volumes of imaging data. The responds with HTTP codes indicating overall success (200 OK for all instances stored without issues), partial success with warnings (202 Accepted), or failure (e.g., 400 Bad Request for syntax errors, 409 Conflict for unsupported Classes), accompanied by an XML response body detailing instance-specific outcomes via modules like the Failed or Referenced . Common use cases for STOW-RS include uploading DICOM instances directly from imaging modalities, workstations, or mobile applications to Picture Archiving and Communication Systems (PACS) or Vendor Neutral Archives (VNAs), enabling seamless integration of new data into enterprise storage without traditional network protocols. For successful stores, the response provides Retrieve URLs for the stored instances, allowing immediate access via other DICOMweb services. Warning reasons in responses, such as coercion of data elements (B000) or discarded elements (B006), inform clients of any modifications, ensuring while accommodating system-specific requirements.

Workflow Services

The Unified Procedure Step Service (UPS-RS), defined in DICOM PS3.18 Chapter 11, provides a RESTful interface for managing procedure steps within workflows, enabling the creation, tracking, and notification of workitems that represent tasks such as image acquisition, processing, or . This service builds on the Unified Procedure Step Service Object Pair (SOP Classes) from PS3.3 Section B.26 and PS3.4 Section CC, allowing clients to interact with a centralized worklist of procedure steps in a standardized manner across distributed systems. Key operations in UPS-RS include the use of HTTP to create new workitems on the worklist resource (e.g., at /rs/workitems), which initiates a procedure step with attributes like scheduled time, information, and codes. Clients can retrieve workitem and details via GET requests on specific workitem resources (e.g., /rs/workitems/{workitemInstanceUID}), supporting queries for current state, details, and referenced SOP instances. Updates to workitem states, such as transitioning from SCHEDULED to IN PROGRESS or COMPLETED, are handled through PUT or operations on the state sub-resource, ensuring real-time synchronization of progress. Subscription mechanisms in UPS-RS facilitate event-driven notifications for coordination, where clients to a subscriber resource (e.g., /rs/workitems/{workitemInstanceUID}/subscribers/{AETitle}) to register for updates on specific workitems or the entire worklist. Upon state changes, the server issues event reports via HTTP to the subscriber's notification endpoint, delivering details in JSON or XML format, which supports asynchronous tracking without constant polling. These subscriptions can filter events by type, such as creation, modification, or cancellation, enhancing efficiency in multi-device environments. UPS-RS integrates seamlessly with modality worklists and other DICOMweb services, linking procedure steps to broader workflows by referencing related instances for input or output, such as studies from services. In enterprise imaging, common use cases include coordinating scan acquisitions across modalities, automating report generation workflows, and enabling real-time subscriptions for teams to monitor procedure completion, thereby reducing delays and improving in clinical settings.

Comparison with Traditional DICOM

Key Differences

DICOMweb fundamentally differs from traditional DICOM in its underlying . While conventional DICOM relies on the DICOM Message Service Element (DIMSE) layered over TCP/IP for communication between application entities, DICOMweb utilizes the HTTP family of protocols to implement RESTful web services. This shift enables seamless integration with standard web infrastructure, such as browsers and cloud environments, without the need for specialized DICOM networking software. In terms of resource modeling and patterns, DICOMweb adopts a stateless, URI-based approach where each operation is self-contained and independent, leveraging HTTP methods like GET, , and PUT to manipulate s such as studies, series, and instances. In contrast, traditional employs stateful associations established through the A-ASSOCIATE service, which maintain a persistent connection for negotiating presentation contexts and exchanging multiple DIMSE commands until explicitly released or aborted. This stateful model supports complex, multi-step workflows but requires ongoing session management, whereas DICOMweb's stateless design aligns with the idempotent nature of RESTful , reducing overhead for distributed systems. Data access mechanisms also diverge significantly. DICOMweb facilitates web-friendly representations by encoding metadata in or XML formats and delivering pixel data via multipart responses or rendered outputs like , allowing direct consumption by web clients without proprietary parsers. Traditional DICOM, however, transmits data exclusively in binary Protocol Data Units (PDUs), necessitating DICOM-specific libraries to interpret the encoded information objects. This binary focus optimizes for high-throughput local networks but limits with general-purpose web tools. Regarding , DICOMweb represents a targeted subset of the standard, emphasizing core operations for query, retrieval, storage, and workflow management of imaging data over the web, without encompassing the full breadth of traditional DICOM services. The latter includes comprehensive support for modalities, print management via Basic Grayscale Print Management SOP Classes, and other institution-centric functions not adapted to web paradigms in PS3.18. This narrower focus positions DICOMweb as an extension for modern, interoperable access rather than a for legacy DICOM deployments.

Advantages and Limitations

DICOMweb offers significant advantages in integrating medical imaging with modern web technologies, facilitating easier development and deployment of applications without requiring specialized DICOM toolkits. By leveraging RESTful web services over HTTP, it enables developers to use standard web programming languages and frameworks, such as JavaScript or Python with HTTP libraries, rather than proprietary DICOM networking protocols. This approach simplifies the creation of web-based viewers and applications that can render DICOM data in browser-compatible formats like JPEG or PNG, supporting seamless access from desktops, mobiles, and cloud environments. Additionally, its use of standard HTTP ports makes it firewall-friendly, avoiding the need to open custom ports typically required for traditional DICOM's DIMSE protocol, which enhances security and compatibility in networked healthcare settings. The standard's alignment with cloud infrastructure further supports scalable, remote access to imaging data, as demonstrated in initiatives like the National Cancer Institute's Imaging Data Commons, where DICOMweb enables efficient querying and retrieval across distributed systems. In terms of , DICOMweb preserves the core information model while providing a web-accessible , allowing proxy gateways to bridge legacy DICOM systems with modern ecosystems without extensive reconfiguration. Its compatibility with HL7 FHIR enables hybrid standards for electronic health records (EHRs), where FHIR handles and DICOMweb manages imaging, improving overall system interoperability and supporting patient-centered workflows across institutions. Despite these benefits, DICOMweb has notable limitations, particularly in supporting advanced features available in the traditional standard. DICOMweb now includes support for the Modality Performed Procedure Step (MPPS) via the Modality Performed Procedure Step and Resources defined in PS3.18 (as of 246, Final Text September 2025), enabling reporting of progress on performed procedure steps executed by imaging modalities. Similarly, there is no native DICOMweb for print management, requiring fallback to DIMSE protocols for hard-copy output, which can complicate hybrid environments. Performance overhead poses another challenge, especially for large datasets, as HTTP-based transfers introduce and demands compared to optimized DIMSE connections; for example, retrieving high-resolution studies over the may require or partial loading to mitigate delays in low- scenarios. This dependency on HTTP infrastructure also means vulnerability to network variability, potentially affecting reliability in resource-constrained settings. Regarding , while superior for contemporary systems, DICOMweb often necessitates gateways for integration with legacy equipment due to vendor-specific implementations and incomplete metadata support, which can lead to inconsistencies in data exchange.

History

Development Milestones

The Digital Imaging and Communications in Medicine () standard originated in , establishing a framework for in exchange. By the 2000s, the growing prevalence of web-based applications and technologies necessitated extensions to DICOM for accessing imaging data via HTTP protocols, addressing limitations of traditional DIMSE (DICOM Message Service Element) services in web environments. A pivotal early occurred in 2003 with the introduction of Web Access to Persistent Objects (WADO) through Supplement 85, which was incorporated into PS3.18 of the standard; this enabled the retrieval of objects using standard web technologies like HTTP GET requests. Building on this foundation, the Standards advanced RESTful web services between 2011 and 2013, defining Query based on ID for Objects (QIDO-RS) for searching studies, series, and instances; Store over the Web (STOW-RS) for multipart HTTP uploads of instances; and Web Access to Objects - Retrieve (WADO-RS) for granular retrieval of and bulk data. These services represented the second generation of web access, emphasizing RESTful architectures for improved scalability and integration with modern web development. In , the suite of RESTful services was officially rebranded as DICOMweb™, aligning it with emerging standards like HL7 FHIR to facilitate broader healthcare . Further enhancements arrived in , including Supplement 203, which added thumbnail resources to WADO-RS for efficient preview generation at , series, and instance levels, and expansions to Unified Step services (UPS-RS) for management, such as subscription-based notifications. The ongoing standardization of is primarily driven by DICOM 27 (WG-27), dedicated to services for DICOM, which coordinates , change proposals, and implementation guides. In 2025, key updates included Change Proposal 2473 (CP-2473), which clarified HTTP response codes for zero-result searches in QIDO-RS to better align with conventions, and 246, introducing Step Services to extend RESTful support for modality worklist and performed procedure step operations.

Evolution from WADO

The Web Access to Objects (WADO) specification originated in 2003 as part of a joint project between and ISO TC/215 to enable HTTP-based retrieval of persistent objects, addressing the limitations of the traditional Message Service Element (DIMSE) protocol, which relied on / connections unsuitable for environments. Introduced formally in Supplement 85 in 2004, WADO provided two variants: WADO-URI, which used HTTP GET requests with URI parameters for simple retrieval of studies, series, or instances, and later WADO-WS, a SOAP-based defined in Supplement 148 in 2011 to support more structured XML exchanges, particularly aligned with IHE Cross-Enterprise Document Sharing for (XDS-I). These mechanisms allowed non- clients to access data without requiring full connectivity, filling a critical gap for browser-based and cross-platform applications. The transition to DICOMweb marked a shift away from the SOAP-based WADO-WS toward fully RESTful services, driven by the need for greater scalability, simplicity, and alignment with emerging web standards. In , DICOM Supplement 198 retired WADO-WS, incorporating its core functionality into enhanced RESTful alternatives while deprecating the more verbose /XML approach in favor of lightweight HTTP methods like GET, , and PUT. This retirement facilitated the rebranding and consolidation of web services under DICOMweb (documented in Part 18 of the standard), emphasizing resource-oriented architectures where objects are treated as addressable web resources via unique identifiers. The move to RESTful design improved with modern web ecosystems, reducing overhead and enabling easier with cloud-based systems. Key evolutions in DICOMweb extended beyond retrieval to encompass full lifecycle management of imaging data. In 2013, Query based on ID for Objects (QIDO-RS, Supplement 166) was added to support searchable queries across studies, series, and instances using HTTP GET with or XML responses, building on WADO's retrieval by enabling discovery without prior knowledge of object UIDs. Concurrently, STore Over the Web - RESTful Services (STOW-RS, 163) introduced secure uploading of objects via HTTP POST, while Web Access to Objects - RESTful Services (WADO-RS, 161) upgraded retrieval to hierarchical endpoints for more efficient access to rendered or native data. Further expansion in 2014 with Unified Procedure Step - RESTful Services (UPS-RS, 171) added workflow capabilities for managing imaging procedures, and the standard increasingly favored metadata over XML for its compactness and compatibility with JavaScript-based clients. This progression from WADO to DICOMweb has had broader impacts on healthcare , aligning with Integrating the Healthcare Enterprise (IHE) profiles such as Mobile Access to Health Documents (MHD) and Mobile Imaging Workflow for enhanced mobile and cross-system access. Additionally, DICOMweb's RESTful structure facilitates mappings to HL7 FHIR resources, such as ImagingStudy, enabling seamless integration of imaging data into electronic health records and broader clinical workflows.

Implementations

Servers

DICOMweb servers provide the backend infrastructure for hosting and exposing RESTful services that enable the , retrieval, and management of data in compliance with the standard. These implementations vary from open-source projects to cloud-native solutions and commercial platforms integrated into picture archiving and communication systems (PACS) or vendor-neutral archives (VNAs). As of 2025, notable servers support core DICOMweb services such as QIDO-RS for querying, WADO-RS for retrieval, STOW-RS for , and sometimes services like UPS-RS. Open-source implementations offer flexible, community-driven options for developers and institutions. The DICOM Server, available on , is a comprehensive open-source platform that supports all core DICOMweb services, including query, retrieve, and store operations, and can be deployed on-premises or in the cloud. It facilitates easy integration with environments and includes features for plugin extensions. Another lightweight option is DICOMcloud, a standalone open-source DICOMweb server that supports and storage backends, providing a simple setup for testing and small-scale deployments. Orthanc, a free open-source DICOM server, integrates DICOMweb through its plugin architecture, enabling RESTful access to stored studies and series while maintaining compatibility with traditional DICOM protocols. Similarly, DCM4CHE offers DICOMweb support via its Java-based toolkit, allowing servers to handle web-based imaging workflows alongside DIMSE operations. Cloud providers have developed managed DICOMweb services optimized for scalability and security. AWS HealthImaging provides for storing and retrieving image sets, with support for authentication and automatic handling of large-scale data through BulkData URIs, enabling efficient processing of petabyte-level archives. Google Cloud Healthcare API implements DICOMweb standards for store and query operations, allowing seamless integration with FHIR resources and supporting high-throughput access to objects in a HIPAA-compliant environment. Azure API for , part of Health Data Services, offers DICOMweb endpoints with custom for change tracking and management, facilitating real-time updates in imaging workflows. Commercial servers often embed DICOMweb capabilities within established PACS and VNA ecosystems for robust enterprise use. Orthanc and DCM4CHE, while open-source at their core, are frequently customized in PACS deployments for production environments. Sectra's VNA solution incorporates DICOMweb for unified access to multimodal imaging data across , , and , supporting secure exchange in large healthcare networks. Agfa HealthCare's Enterprise Imaging platform, including its VNA, integrates DICOMweb services to consolidate and share images from diverse sources, emphasizing in multi-site installations. These offerings prioritize vendor-neutral standards to avoid lock-in and enable federation with cloud services. Many servers include advanced features such as proxying to legacy DIMSE protocols, allowing seamless bridging between web-based and traditional DICOM clients without requiring full infrastructure overhauls. is a practice, with implementations like Azure's DICOM service publishing detailed statements to verify adherence to the DICOMweb specification. In 2025, the scale of DICOMweb adoption is evident in systems like Dicom Systems' Unifier platform, which processes 98 billion medical images annually, nearly doubling the previous year's volume and underscoring the technology's role in global healthcare imaging workflows.

Clients

DICOMweb clients are software libraries, tools, and applications designed to interact with DICOMweb services, enabling the querying, retrieval, and storage of data over RESTful . These clients facilitate integration into , and mobile environments, supporting healthcare workflows without requiring proprietary protocols. Prominent libraries include the Python-based dicomweb-client, available on PyPI, which provides interfaces for key DICOMweb RESTful services such as QIDO-RS for searching DICOM objects, WADO-RS for retrieving them, and STOW-RS for storing them. This library offers both an API and command-line interface, allowing developers to handle DICOM Part 10 files and interact with servers like Orthanc or dcm4chee-arc-light. In , the dicomweb-client library implements the PS3.18 standard for web applications, supporting operations like storing instances via STOW-RS, querying studies with QIDO-RS, and retrieving data through WADO-RS. It is particularly suited for web viewers, enabling progress tracking during data transfers and integration into browser-based environments via installation. Among tools, .js serves as a foundational for rendering images in web applications, with built-in support for DICOMweb protocols including WADO-RS and all transfer syntaxes for progressive streaming and GPU-accelerated display. The dcm4che toolkit, a Java-based suite, includes DICOMweb client capabilities for querying studies via QIDO-RS, retrieving rendered images or metadata in /XML formats through WADO-RS, and storing objects with STOW-RS, making it versatile for both development and clinical tools. Weasis, an open-source DICOM viewer, supports DICOMweb imports via QIDO-RS, WADO-RS, WADO-URI, and STOW-RS, with configurations for like OAuth2; it aligns with IHE profiles for query/retrieve operations, enabling seamless integration in healthcare systems. Common use cases for DICOMweb clients encompass browser-based viewers that leverage WADO-RS to display images directly in web interfaces, AI pipelines where QIDO-RS queries datasets for training on medical images, and mobile applications that access APIs for remote viewing and management of DICOM data in lightweight /XML formats. As of 2025, DICOMweb clients show increased adoption in FHIR-integrated applications, where services bridge imaging data with clinical records for enhanced in cloud-native platforms. Additionally, mitigations for client authentication vulnerabilities emphasize TLS encryption and OAuth2 implementations to address exposures in unsecured systems, as outlined in DICOM PS3.15 security profiles.

Security and Compliance

Security Features

DICOMweb supports the use of for all communications to ensure , leveraging TLS as specified in RFC 2818 and RFC 7525. The standard incorporates TLS Security Profiles from Supplement 230, including the BCP 195 RFC 8996, 9325 TLS Secure Transport Connection Profile, which requires support for TLS 1.2 and 1.3, prefers TLS 1.3 if offered by the client, and prohibits negotiation down to TLS 1.0 or 1.1. A modified version for legacy compatibility may allow limited downgrading under specific conditions, but modern implementations as of 2025 emphasize TLS 1.3 for stronger encryption and . Authentication in DICOMweb relies on standard HTTP mechanisms outlined in 7235 and 7236, with specifics deferred to security profiles in PS3.15. OAuth 2.0 with Connect (OIDC) is widely adopted for secure token-based authentication, as seen in cloud implementations such as AWS HealthImaging, which supports OIDC for DICOMweb API requests to verify user identity and permissions. Similarly, Google Cloud Healthcare API integrates OAuth 2.0 bearer tokens for authorizing access to DICOMweb endpoints. API keys are also used in some cloud services for simpler, though less granular, authentication. Access control in DICOMweb employs role-based mechanisms through scopes, enabling fine-grained permissions such as read-only access to specific studies or instances. De-identification tools integrate with PS3.15's Attribute Confidentiality Profiles, particularly the Application Level Confidentiality Profile, which removes or modifies sensitive patient attributes before transmission over web services to protect . Options within these profiles, like cleaning pixel data or recognizable visual features, allow tailored anonymization while maintaining data utility. Vulnerabilities in DICOMweb deployments have been highlighted in 2025 reports, with numerous PACS servers found exposed online due to misconfigured interfaces, potentially allowing unauthorized access to sensitive images. Specific issues include unencrypted in portals, as detailed in CISA advisories for products like Sante PACS . Mitigations emphasize network-level protections such as firewalls to restrict exposure and comprehensive audit logs to monitor access attempts and detect anomalies. DICOM-specific security extends PS3.15 profiles to web services, including Secure Transport Connection Profiles that apply TLS for encrypted DICOM object handling and the Online Electronic Storage Secure Use Profile for tracking SOP Instances securely. These ensure and of DICOM data during RESTful exchanges, building on traditional DICOM security without altering core object structures.

Regulatory Compliance

DICOMweb facilitates compliance with the Health Insurance Portability and Accountability Act (HIPAA) through its with (FHIR), enabling secure sharing of (PHI) in medical imaging workflows. This supports of DICOM instances for research purposes, such as via the Over the Web - RESTful Services (STOW-RS) , which allows storage of anonymized data while adhering to HIPAA's privacy rules for removing identifiable information. In alignment with the General Data Protection Regulation (GDPR) and similar international privacy frameworks, DICOMweb incorporates audit trails and consent management features within its Unified Procedure Step - RESTful Services (UPS-RS) for workflow orchestration, ensuring traceability of data access and processing to meet data subject rights and accountability requirements. DICOMweb demonstrates conformance to Integrating the Healthcare Enterprise (IHE) profiles, notably Cross-Enterprise Document Sharing for Imaging (XDS-I), which leverages DICOMweb services like Retrieve (WADO-RS) for secure, cross-enterprise image sharing. Additionally, it aligns with U.S. (FDA) guidance on data systems (MDDS), where web-based image storage and communication functions that merely transfer, store, or display data without alteration are exempt from certain premarket review requirements, promoting efficient deployment in regulated environments. As of 2025, DICOMweb implementations in cloud environments have enhanced compliance through service organization control (SOC) reports from providers like Amazon Web Services (AWS) HealthImaging and Google Cloud Healthcare API, which cover HIPAA-eligible services and address vulnerabilities in public exposures via automated encryption and access controls. Best practices for DICOMweb emphasize conducting risk assessments to identify exposure points and implementing at rest (e.g., AES-256) and in transit (e.g., TLS 1.3 via ) to safeguard and across deployments.

References

  1. [1]
    DICOMweb™
    DICOMweb is the DICOM Standard for web-based medical imaging. It is a set of RESTful services, enabling web developers to unlock the power of healthcare images.DICOMweb Cheatsheet · DICOMweb Resources · Retrieve (WADO-RS)
  2. [2]
    PS3.18 - DICOM - NEMA
    PS3.18 specifies web services (using the HTTP family of protocols) for managing and distributing DICOM (Digital Imaging and Communications in Medicine) ...
  3. [3]
    History - DICOM Standard
    The name was changed to DICOM (Digital Imaging and COmmunications in Medicine), and published as NEMA Standard PS3. 1995. Ultrasound, X-ray angiography, and ...
  4. [4]
    DICOMweb Resources
    A fully implemented DICOMweb server (including optional services) exposes the following RESTful resources.
  5. [5]
    [PDF] PS3.18​ - DICOM - NEMA
    PS3.18​. DICOM PS3.18 2025d - Web Services​. Page 2. PS3.18: DICOM PS3.18 2025d - Web Services​. Copyright © 2025 NEMA​. A DICOM® publication​. - Standard -​.
  6. [6]
    Thumbnail Service over DICOMweb
    This supplement adds thumbnail handling to web services in part 18 of the DICOM standard. This supplement defines Thumbnail resources on the WADO-RS Study, ...
  7. [7]
    7 Overview of DICOM Web Services (Informative)
    This Part of the Standard defines DICOM Web Services. Each service allows a user agent to interact with an origin server to manage a set of DICOM Resources.
  8. [8]
    DICOMweb™: Background and Application of the Web Standard for ...
    May 10, 2018 · DICOMweb is a web-based extension of the DICOM standard for medical imaging, enabling interoperability and collaborative use of medical imaging.
  9. [9]
  10. [10]
  11. [11]
  12. [12]
  13. [13]
  14. [14]
  15. [15]
  16. [16]
  17. [17]
  18. [18]
  19. [19]
  20. [20]
  21. [21]
  22. [22]
  23. [23]
  24. [24]
    [PDF] Supplement 203: Thumbnail Resources for DICOMweb
    The URL of the Thumbnail resource is created by adding. "/thumbnail" to the URL of the parent DICOM resource. Table 11.4.1-3. Retrieve Transaction Thumbnail ...
  25. [25]
    [PDF] DICOM Change Proposal
    Jul 28, 2025 · Change Number. CP-2473. Log Summary: Clarify HTTP response codes for zero result in Search Transaction. Name of Standard. PS3.18. Rationale for ...
  26. [26]
    A Data Exchange Models - DICOM - NEMA
    The Native DICOM Model defines a representation of binary-encoded DICOM SOP Instances as XML Infosets that allows a recipient of data to navigate through a ...
  27. [27]
  28. [28]
  29. [29]
  30. [30]
  31. [31]
  32. [32]
  33. [33]
  34. [34]
  35. [35]
    10.5 Store Transaction - DICOM
    This transaction uses the POST method to Store representations of Studies, Series, and Instances contained in the request payload.Missing: STOW- RS
  36. [36]
    [PDF] Sup163 Store Over the Web by RESTful Services (STOW-RS) - DICOM
    Aug 19, 2013 · HTTP/1.1 STANDARD RESPONSE CODES. Service Status. HTTP/1.1 Status Code. STOW-RS Description. Failure. 400 – Bad Request.
  37. [37]
    Store (STOW-RS) - DICOM
    STore Over the Web (STOW) enables you to store specific instances to the server. The specification can be found in PS3.18 10.5.
  38. [38]
    11 Worklist Service and Resources - DICOM
    The Worklist Service, also known as UPS-RS, defines a RESTful interface to the Unified Procedure Step Service SOP Classes defined in Section B.26 “Unified ...
  39. [39]
    1 Scope
    ### Summary of DICOM PS3.18 Chapter 1
  40. [40]
    7 OSI Upper Layer Service for DICOM Application Entities
    ### Summary: DICOM Associations and A-ASSOCIATE Service
  41. [41]
    Thirty Years of the DICOM Standard - PMC - NIH
    Oct 6, 2023 · It also explores the advantages and limitations of the standard while outlining some potential future developments. ... DICOMweb enables ...
  42. [42]
    [PDF] DICOM Educational Conference Brisbane, Australia
    ▫ DICOM® is a registered trademark of NEMA; DICOMWeb™ is a trademark of ... Advantages of FHIR. ▫ HTTP and REST. ▫ Improved interoperability.
  43. [43]
    [PDF] DICOMweb Modality Services
    Is mapping from MPPS' Performed Procedure Step. Status DISCONTINUED to / from UPS' Procedure. Step State CANCELLED semantically correct? And what about the ...
  44. [44]
    Web-Based DICOM Viewers: A Survey and a Performance ...
    Sep 30, 2024 · DICOM was developed to address the challenges of interoperability in medical imaging, ensuring that images and associated patient data can be ...
  45. [45]
    SIIM Hackathon gives DICOMWeb a coming-out party
    May 20, 2014 · The first three APIs were released in October 2013: QIDO-RS (query, lookup), WADO-RS (retrieve), and STOW-RS (storage). The RS refers to REST- ...
  46. [46]
    DICOM News - NEMA
    DICOM News ; UPS by Restful Services. Sup 171. Final Text in November 2014 ; Parametric Maps. Sup 172. Final Text in November 2014 ; MPR Presentation State. Sup ...
  47. [47]
    WG-27: Web Services for DICOM
    Current Supplements, Work and Objectives: · DICOMweb 3D rendering · Various other small CPs · RESTful Modality Worklist · Guide for DICOMweb implementation and ...
  48. [48]
    [PDF] cp2473_01_clarify_response_for_ zero_result_PS3
    Dec 16, 2024 · CP-2473. Log Summary: Clarify HTTP response codes for zero result in Search Transaction. Name of Standard. PS3.18. Rationale for Change: During ...
  49. [49]
    [PDF] Supplement 246: DICOMweb Modality Procedure Step Services
    Sep 16, 2025 · It corresponds to the DIMSE Modality Worklist (MWL) service as defined in Annex K of PS3.4 and has the same semantics. 14.1.1. Resource ...
  50. [50]
    [PDF] Navigating The Next Evolution Of DICOM In Enterprise Imaging
    History of DICOMweb. ▫. DICOM and Enterprise Imaging. ▫. What's next for DICOM ... DICOMweb – Brief History. •. 1993 – DICOM 3.0 issued – TCP/IP-based but ...Missing: timeline | Show results with:timeline
  51. [51]
    [PDF] Supplement 198: Retire WADO-WS - DICOM Standard
    Feb 6, 2013 · This supplement retires the WADO-WS Web Service from the Standard. The functionality provided by WADO-WS is now included in and enhanced by ...
  52. [52]
    DICOMweb - Orthanc - DICOM Server
    Loading the plugin into Orthanc will provide support of WADO-URI (previously known simply as WADO), WADO-RS, QIDO-RS and STOW-RS. The full standard is not ...Missing: RSNA 2011 2013
  53. [53]
    dcm4che/dicomweb - GitHub
    DICOMweb is a term applied to the family of RESTful DICOM services defined for sending, retrieving and querying for medical images and related information.
  54. [54]
    Using DICOMweb with AWS HealthImaging
    Oct 14, 2025 · DICOMweb APIs are used to retrieve DICOM objects from AWS HealthImaging, which stores data as image sets. These APIs are not offered through  ...Missing: servers Google Azure
  55. [55]
    AWS HealthImaging now supports DICOMweb BulkData
    Jul 1, 2025 · HealthImaging automatically replaces DICOM data elements over 1 MB in size with in-line BulkDataURIs, in accordance with the DICOMweb standard.Missing: Google Azure
  56. [56]
    Overview of the DICOM service in Azure Health Data Services
    Jul 23, 2025 · With the DICOM service, organizations are able to store references to imaging data in FHIR and enable queries that cross clinical and imaging ...
  57. [57]
    Sectra VNA for enterprise imaging strategies
    Sectra VNA lets you consolidate your image handling through a single centralized, standards-based multimedia archive. Capture, store, access and exchange.Missing: Agfa | Show results with:Agfa<|separator|>
  58. [58]
    18 Web Services - DICOM
    PS3.18 specifies web services (using the HTTP family of protocols) for managing and distributing DICOM (Digital Imaging and Communications in Medicine) ...
  59. [59]
    DICOM Conformance Statement v2 - Azure - Microsoft Learn
    Jul 15, 2025 · Read about the features and specifications of the DICOM service v2 API, which supports a subset of the DICOMweb Standard for medical imaging ...
  60. [60]
    Dicom Systems Processes 98 Billion Medical Images Annually ...
    Dec 3, 2024 · The number of medical studies processed also grew dramatically, jumping from 254 million in 2023 to 481 million in 2024. This exceptional growth ...
  61. [61]
    Introduction — dicomweb-client 0.59.1 documentation
    The dicomweb-client build distribution provides client intefaces for DICOMweb RESTful services QIDO-RS, WADO-RS and STOW-RS to search, retrieve and store DICOM ...
  62. [62]
    dicomweb-client - PyPI
    Client for DICOMweb RESTful services. Project description DICOMweb Client Build Status PyPi Distribution Python Versions Downloads Python client for DICOMweb ...
  63. [63]
    dicomweb-client
    ### Summary of dicomweb-client JavaScript Library
  64. [64]
    Cornerstone.js | Cornerstone.js
    Robust DICOM Parsing. Supports DICOMweb and all transfer syntaxes out-of-the-box. Fast. High performance GPU-accelerated image display.Examples · Overview · Cornerstonejs/core · Cornerstonejs/tools
  65. [65]
    DICOMWeb Import :: Weasis Documentation
    dcm4chee-arc-light · To add the Weasis client: Click on “Clients” in the left menu; Click the “Create” button · Configure the new client in general settings:.
  66. [66]
    RSNA 2025: Five Trends Shaping Radiology's Next Chapter - Rad AI
    Nov 4, 2025 · The Interoperability Pavilion and Technical Exhibits will showcase how DICOMweb, FHIR, and cloud-native platforms are redefining data ...
  67. [67]
    [PDF] PS3.15​ - DICOM Standard
    This pattern provides SSL/TLS authentication and encryption between client and server. It requires additional​ setup during installation because the TLS ...
  68. [68]
    [PDF] Supplement 204 – TLS Security Profiles - DICOM Standard
    Mar 23, 2018 · The HTTP/HTTPS connection for DICOMWeb can be shared with other HTTP/HTTPS traffic. "2762 dicom-tls" for the DICOM Upper Layer Protocol on TLS. ...
  69. [69]
    OIDC authentication for DICOMweb APIs - AWS HealthImaging
    Oct 14, 2025 · AWS HealthImaging supports OAuth 2.0 -based authentication for DICOMweb API requests using OpenID Connect (OIDC) , in addition to the ...
  70. [70]
    Integrating with a DICOM medical viewer | Cloud Healthcare API
    Google Cloud APIs support the OAuth 2.0 protocol for both authentication and authorization. ... The Cloud Healthcare API supports the DICOMweb standard. To ...Authorizing and authenticating... · Accessing DICOMweb endpoints
  71. [71]
    DICOM storage and transport | Health AI Developer Foundations
    Feb 11, 2025 · The DICOMweb storage system either must support public access or accept OAuth 2.0 bearer tokens for authorization. Was this helpful?
  72. [72]
    15 Security and System Management Profiles - DICOM Standard
    This Part of the DICOM Standard specifies Security and System Management Profiles to which implementations may claim conformance.
  73. [73]
    Uncovering New Vulnerabilities in PACS Servers and DICOM Viewers
    May 12, 2025 · As of April 2025, numerous PACS servers and DICOM nodes were found to be accessible online, making them vulnerable to cyber threats.Missing: client | Show results with:client
  74. [74]
    Santesoft Sante PACS Server | CISA
    Aug 12, 2025 · The Sante PACS Server Web Portal sends credential information without encryption. CVE-2025-54156 has been assigned to this vulnerability. A CVSS ...
  75. [75]
    DICOM and HIPAA Compliance: Requirements, Best Practices, and ...
    Mar 28, 2024 · Learn DICOM de-identification and HIPAA compliance to reduce risk, preserve utility, and get a checklist and incident-response steps for ...
  76. [76]
    8.11 Security and Privacy - DICOM
    Privacy regulations in the United States (HIPAA), Europe (GDPR), and elsewhere, require that Individually Identifiable Information be kept private. It is ...
  77. [77]
    [PDF] IHE Radiology Technical Framework Supplement Web-based Image ...
    Jun 15, 2023 · WIA can be used with different image sharing infrastructures, including but not limited to XDS / XDS-I and DICOM / DICOMweb. The Imaging ...Missing: conformance | Show results with:conformance
  78. [78]
    Medical Device Data Systems, Image Storage, and Image ... - FDA
    Sep 28, 2022 · This guidance provides clarity and predictability for manufacturers on FDA's thinking for Medical Device Data Systems (MDDS).<|control11|><|separator|>
  79. [79]
    Compliance validation for AWS HealthImaging
    Validate compliance for Amazon WorkSpaces with third-party audits, FedRAMP, HIPAA, and AWS Config rules. Access compliance reports via AWS Artifact. June 28, ...
  80. [80]
    Overview of the Cloud Healthcare API - Google Cloud Documentation
    The FHIR portion of the REST API conforms to the DSTU2, STU3, and R4 FHIR specifications. The DICOM portion of the REST API conforms to DICOMweb, a web-based ...
  81. [81]
    [PDF] Keeping it Safe – Securing DICOM
    DICOM security includes protecting access, integrity, loss, and availability. Use DICOM-TLS, HTTPS, and appropriate authentication measures. Consider security ...Missing: friendly | Show results with:friendly
  82. [82]
    DICOM and HIPAA Compliance: A Practical Guide to Secure ...
    Mar 19, 2024 · In transit: enforce TLS 1.2+ (prefer TLS 1.3) with strong cipher suites and certificate pinning/mutual TLS between trusted nodes. At rest: use ...