Most small imaging practices already have a backup. That is not where they are exposed. The exposure is that the backup is the PACS vendor's own appliance, sitting in the same closet as the PACS, on the same circuit and the same domain. One sprinkler head, one flooded slab, one set of stolen domain admin credentials, and both copies go together. That is not a second copy. That is the first copy with a second chassis around it.
Ransomware crews go after the backup first, because a working restore is the only thing that costs them their payment. If your archive is a Windows share the PACS server can write to, so can the encryptor.
DICOM is unusually hostile to the backup tools you already own
Ordinary business data churns. Files get edited, versions expire, and backup products assume that.
Imaging data does the opposite. A study is written once, signed off, and never touched again. It is large, a single CT or MR study can run to thousands of objects, and it must be kept for years. Retention is set by state law, not by HIPAA, so check your own rule rather than a number off a vendor slide. Seven years for adults is a common benchmark, and minors run longer, often counted from the age of majority.
The result is an archive that only grows and must outlive the hardware it was written on. Naive file-level backup copies it fine and falls down on what matters: getting a study back into a PACS that will actually ingest it. Restoring files is not the same as restoring an archive.
Per-study pricing bills you for the thing you want more of
Many cloud archive vendors charge per study. That indexes your archive bill to exam volume, the number you are trying to grow. Add a second scanner, hire a radiologist, absorb an orthopedic group's overflow, and the line item follows you up. The better your year, the worse the invoice.
Soteria Cloud Archive has no per-study charge. Capacity is sold in storage tiers, currently 200 GB, 400 GB, 700 GB, and 2 TB and up, so the bill tracks what you keep rather than what you scan, which is a number you can forecast.
Lock-in is the quiet risk, and it shows up years later
The failure nobody plans for is not a fire. It is switching PACS in 2031 and finding out the archive is readable only by the vendor you are leaving. The migration quote that arrives is technically an invoice and functionally a ransom, because the alternative is walking away from your own patient history.
Vendor-neutral is the defense, and it is a storage-format question, not a marketing one. Soteria is DICOM 3.0 compliant and works with all major PACS, so studies sit in the archive as standard DICOM objects, not inside one vendor's container. That is what decides whether the next PACS you buy can read them.
Three questions to ask any archive vendor, us included
- Can I pull a full DICOM-conforming export myself, without a professional services engagement? Get it in writing. A "yes, of course" on a sales call becomes a scoped project later.
- What is the real retrieval time for a five-year-old study? Not the SLA for last week's exams. Cold storage can mean hours. Fine if you know in advance, a problem if you learn it during a subpoena.
- Will you sign a BAA? A vendor holding PHI who will not sign a business associate agreement is not a healthcare vendor, whatever the website says.
HIPAA's contingency plan standard, 45 CFR 164.308(a)(7), requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan. It names no products, and no vendor can hand you compliance.
Which is the caveat. An offsite archive covers one of those three and leaves the other two to you. If your PACS server dies on a Tuesday, images safe in the cloud do not give you a reading workstation, a worklist, or an interface to the EHR. You still need the document that says who calls whom, what you read on in the meantime, and how long you can run on paper. Better written down badly than not at all.
Tiers and ingest details are on the Soteria Cloud Archive page. Ask us those three questions before you ask anyone else. If the honest answer is to keep the archive you have and fix only the offsite copy, that answer costs nothing.
