Sharing scans with referring doctors

By SOMATIQ team · 1 September 2026

Walk into almost any imaging centre in India at 7 pm and you will see it. A referring surgeon calls the front desk: "Send me the CT, the patient is in my OPD." Someone at the console takes a phone, photographs four slices off the monitor, and sends them on WhatsApp. Sometimes the radiologist does it personally, because the surgeon is a friend and the patient is waiting.

Nobody in this story is doing anything malicious. They are trying to help a patient, and the other options available to them (a CD, a PACS login, a printed film) are slower. But a photo of a monitor is a poor way to share a scan, and the law has now caught up with it. So, let's look at why this habit is so persistent, what is wrong with it clinically and legally, and what a better way of sharing has to offer before anyone will actually use it.

Why scans end up as phone photos

It is worth being honest about why this happens, because no policy will fix it if the underlying reasons remain. In our experience the reasons are nearly always the same four.

No easy way inViewing a study means a VPN, a desktop client or a PACS login nobody remembers, so the clinician asks for a photo.

CDs are slow and nobody has a driveMost laptops sold today have no optical drive, and a CD only reaches the doctor when the patient physically carries it.

The report is not ready yetThe surgeon wants to see the fracture now, not in three hours.

WhatsApp is already openEvery doctor in India has it. It costs nothing and needs no training.

So the photo wins on convenience every time. The problem is what you lose, and that comes in two parts: what the doctor can no longer see, and where the patient's data ends up.

What goes wrong with a photo on WhatsApp

Clinically, a photo is a poor copy. You get the four slices someone chose, at whatever window they happened to be on, with moiré from the monitor and no ability to scroll, change window, measure or look at another plane. A subtle finding outside those four images does not exist for the person receiving it. A CT is a volume of several hundred images; a photo turns it back into something less than a film.

From a privacy point of view, it is worse. The image usually carries the patient's name, age and ID on the overlay. It now sits in the gallery of the person who took it, in the chat history of the person who received it, often in a group, and in whatever cloud backup both phones use. There is no way to take it back, no record of who forwarded it, and no expiry.

This is not a new worry. As far back as 2017, a letter in the Indian Journal of Medical Ethics, "WhatsApp, Doc?", laid out the same risks: data that looks anonymous becomes identifying when combined, group chats spread it further, and personal phones get lost or used by family members. In the author's small informal survey of doctors, only one respondent even mentioned encryption.

What the DPDP Act and Rules change

India's Digital Personal Data Protection Act, 2023 applies to digital personal data, and a patient's scan with their name on it is exactly that. The DPDP Rules, 2025 were notified on 13 November 2025, with most of the substantive obligations on organisations coming into force after an 18-month transition, in May 2027. Our DPDP guide for imaging centres goes through the Act and Rules in more detail.

In plain terms, the parts an imaging centre should read carefully are these:

Notice and consent. Patients have to be told, in clear language, what data is collected and why, and how to withdraw consent.
Reasonable security safeguards. The Rules describe measures such as encryption, access control, logging of access and backups, as summarised by SCC Online.
Breach notification. Affected individuals and the Data Protection Board have to be informed, with a detailed report to the Board within 72 hours.
Penalties. The government's own explainer notes penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, and up to ₹200 crore for failing to notify a breach.

Think about the 7 pm phone photo against that list. Who logged the access? Can the centre say where the image went? If a phone with a hundred patient photos is lost, is that a breach the centre has to report? We are not lawyers and this is not legal advice. Every centre should sit down with its own counsel and work out what the Act and Rules mean for its specific workflows. But it is hard to imagine anyone arguing that unlogged photos in personal galleries meet the standard.

What good sharing looks like

Good sharing has to beat WhatsApp on convenience, or people will go back to WhatsApp. That is the design test, and it is the one most "secure portals" fail. Beyond that, a sharing method worth adopting is characterised as follows.

A link, not a file. The doctor gets a link to the study. The images stay on the centre's server.
The link expires. It works for a sensible window and then stops working. A link lying in a chat for two years should not still open a scan.
The link is tied to someone. Only verifying the recipient, for example with a one-time code sent to the doctor's number, stops a forwarded link from working; limiting a link to one study and a short lifetime reduces what a forwarded link exposes, but anyone holding it can still open it until it expires.
A real viewer in the browser. The full study opens on a phone or laptop with no install: scroll through slices, change window, measure. (A zero-footprint viewer is what makes this possible.) Now the doctor sees everything the radiologist saw, not four chosen frames.
An audit trail. Every link created, every open, with time and who. If someone asks "who saw this patient's MRI?", the centre can answer.
Consent recorded where it belongs. Sharing with the referring doctor should be part of the patient's documented consent at registration, not an afterthought.
The report travels with the images. Once it is signed, the same link should show it.

None of this is exotic. It is basic access control, applied to the way Indian doctors actually work. The trade-off is that it has to be built into the system that holds the images; it cannot be bolted on by asking staff to be more careful.

Link vs images: why the difference matters

At SOMATIQ, our platform sends study links to referring doctors over WhatsApp. That can sound like the same thing we just criticised, so it is worth being precise about the difference.

Sending a link keeps images in the archive; sending a photo lets patient data travel.

When a photo goes on WhatsApp, the patient data itself travels. Copies end up on every phone and every backup along the way, and the centre loses control the moment it hits send.

When a link goes on WhatsApp, WhatsApp is only the delivery channel, the same way an SMS carries an OTP. What travels is a pointer. The images remain in the archive, the doctor opens them in the browser viewer, and access is controlled and logged on the centre's side. If the link is revoked or expires, it stops opening. That does not undo screenshots, downloads or anything the browser has cached, which is why the viewer's download and caching settings matter too.

We kept WhatsApp as the channel deliberately. Referring doctors already live there, and asking a busy orthopaedic surgeon to download a new app to see one X-ray is how you end up back at phone photos. Because sharing sits inside the same platform that handles registration, scheduling, billing, acquisition and reporting, the consent captured at the front desk and the signed report are part of the same record the link points to. (For how those pieces divide up in a typical centre, see RIS, PACS or RIS-PACS.) The same idea applies across a chain: on one system for every centre, a referring doctor gets the same kind of link whichever branch did the scan.

What this means for a centre

A short checklist for the next month:

Find out how scans actually leave your centre today. Ask the technicians at the evening shift, not the manager.
Make "photos of the monitor" a written no, and give staff something faster to use instead.
Check that your PACS can send expiring study links that open in a browser.
Confirm that access to those links is logged, and that you can pull the log.
Add sharing with referring doctors to your registration consent wording, with your counsel's help.
Decide how a referring doctor gets the signed report, so they stop asking for screenshots of it.

The practical upshot is that the aim is not to stop doctors talking on WhatsApp. It is to stop patient data living there. A centre that gives its referrers something faster than a photo, with an expiring link, a full browser viewer and a log behind it, will find the photos stop on their own, and it will be in a far better position when the DPDP obligations take full effect in 2027.

FAQ

Is it illegal to send scan images on WhatsApp in India?

The DPDP Act does not name WhatsApp, but from around May 2027 it requires centres to protect patient data with reasonable security safeguards and to handle breaches properly, with penalties of up to ₹250 crore for security failures. Uncontrolled image copies on personal phones are hard to square with that. Talk to your counsel about your specific workflow.

When do the DPDP Rules apply to imaging centres?

The Rules were notified on 13 November 2025. Most obligations on data fiduciaries, including notice, security safeguards and breach reporting, take effect 18 months later, in May 2027.

What is the difference between sending a study link and sending images?

A photo or file is a copy of the patient's data that you can never recall. A link points to images that stay on the centre's server, so access can expire, be revoked and be logged.

Do referring doctors need to install software to view a shared study?

Not with a browser-based viewer. The doctor opens the link on a phone or laptop and sees the full study, with scrolling, windowing and measurements.

Ready to see your workflow on one platform?

We will walk you through the whole workflow, from registration to signed report.