Security
Statements

With reference to the article "Millions of patient data unprotected on the internet" by Bayerischer Rundfunk [1], we would like to inform you again about how extensively "mRay" protects your data.

The leaks mentioned in the report involve unprotected PACS systems via the Internet. According to ARD Tagesschau, these breakdowns occurred during the import of CDs or due to misconfigurations of the computers carrying the data [2].

Our mRay application offers a wide range of protection so that such mishaps cannot occur. Images downloaded through the mRay app are stored in a proprietary format and contain only the information necessary for display. There is no way in the app to gain access to the original DICOM files. The transfer of this proprietary data format is also done via an AES-256-bit encrypted connection. Access to the data is controlled via password-protected authentication and authorization management.

DICOM data is only cached on the appropriate hospital server running mRay so that it can be converted to the proprietary format. At no time is the storage done via a cloud service provider, the data sovereignty remains with you. Again, this caching is done via encryption. Since mRay is not a PACS or data archive, the data is only kept on the server for a preset time (default setting: 2 days). The same applies to the end devices (default setting: 8 hours).

According to the recommended scenario, all mRay servers are located in the hospital's internal network and not in the DMZ, so that direct access from outside is not possible. In this case, the gateway in the DMZ only acts as a data mediator, which forwards the encrypted data traffic and accordingly serves as a link between the mRay app and the mRay server. No data is stored in the DMZ. After random analysis of customer servers, no unusual data traffic or strange behavior patterns were observed.

The security architecture of the mRay application is a continuously tested key component of the software to ensure that data leaks like the ones mentioned in the article will be a thing of the past in the future. More information about mRay's security concept and data protection handling can be found in the attached infosheets.

We thank you and are at your disposal for any further questions.

[1] https://www.br.de/nachrichten/deutschland-welt

[2] https://www.tagesschau.de/investigativ/br-recherche/patientendaten-leck-suche-101.html