Everything inside MiniPACS + Vendo

Reading

Stone opens a study while OHIF was still loading.

The Stone Web Viewer cold-opens a 10-series, 180-instance study in about 0.6 seconds on the machine that runs it; the OHIF-based viewer it replaced took 35 seconds for the identical study, nearly 50 times slower, a conservative figure (the measured gap was even larger). A radiologist clicks a row mid-shift and the images are already there before the click finishes registering.

A whole keyboard-driven reading mode laid over the worklist.

Press "g" then a letter and the app jumps straight to a section, Worklist, Reports, Settings, the same two-key pattern Vim and Gmail use; a 900-millisecond window catches the second key, "?" opens a full cheat sheet, and every shortcut is filtered by the user's real permissions. A radiologist who lives in these shortcuts never touches the mouse to move between sections during a whole shift.

Cmd+K reaches into live patient data, not a static menu.

From two typed characters, a 250-millisecond-debounced search hits both patients and studies in parallel and groups the results under two headers, full arrow-key navigation included. A radiologist gets a call about a patient by name, hits Cmd+K, types the surname, and has both the patient record and the latest study on screen without opening the worklist page at all.

Burn to CD/USB shows real progress, not a frozen spinner.

The button label itself narrates the build: "Burn to CD/USB" becomes "Building ISO on server..." then "Downloading 340 MB / 512 MB" with real bytes, and an "include reports" checkbox decides whether the signed PDF rides along. The disc that comes out is a genuine ISO 9660 with a DICOMDIR, so a plain right-click burn in Windows opens on the receiving hospital's own viewer with no extra software installed.

The compare view is honest about a limit rather than faking a fix: opening a study side-by-side with a prior discloses right on the page that panes scroll independently and Stone viewers cannot be linked, and the chosen prior study lives in the URL, so a refresh or a back-button press lands on the exact same comparison.

Reporting

Full detail on the reporting workflow lives on radiology reporting software. Draft moves to final, to signed, with addenda after that, each stage behind its own guardrail rather than one free-text box; here are the parts that actually change a radiologist's day.

Dictation understands "next section," not just words.

Saying "new paragraph" inserts a line break instead of typing the words; saying "next section" stops dictation and, 300 milliseconds later, switches the microphone itself to the next form field, Findings into Impression and onward. If recognition drops mid-sentence, the system restarts it automatically within 250 milliseconds; only an explicit permission denial stops it for good. A radiologist dictates Findings, says "next section," and keeps talking into Impression without touching the mouse or the viewer.

A clinic's own shorthand expands as you type it.

Eleven built-in dot-phrases, .nl .wnl .nad .compare .noprior .stable .limited .motion .corr .fu .incidental, expand into full boilerplate the instant they are followed by a space, no menu trip required. A radiologist types their usual normal-lungs phrase and a space, and the paragraph is already there.

Switching templates never destroys what you already typed.

Thirteen built-in RadReport-style templates ship by default, and switching between them mid-report distinguishes untouched scaffold text from anything the physician actually wrote, only the untouched boilerplate gets replaced. A radiologist picks the wrong template but has already typed a real finding; switching to the correct one leaves their own words in place and clears only what was never touched.

A critical finding gets a delivery status, not a fire-and-forget email.

Flagging a finding as critical or urgent shows live status, "Not sent," "Awaiting acknowledgement," or "Acknowledged HH:MM," with a one-click resend if the send fails and the recipient's name autocompleting from the address book. A radiologist finds a pneumothorax, sets severity to critical, and if the mail server is down the panel says so honestly instead of pretending the email went out.

Sharing and the patient portal

Full detail lives on medical image sharing.

A guest reads images and the report with nothing installed.

The PIN screen is a large monospace 4 to 6 digit field with a paste-from-clipboard button that strips everything except the digits, so a PIN forwarded in a text message pastes clean even with stray words around it. "View Images" opens the viewer inline in the clinic's own branding; "View Report" opens the signed PDF the same way, both with their own fullscreen toggle. An elderly patient copies a whole text message, taps paste, and reads the radiologist's report on their phone without installing anything.

Opening Share checks for an existing link before making a new one.

The dialog looks up the patient's already-active share links, expiry, PIN, view count, before offering to create another; the QR code it generates can be saved as a PNG or sent to a dedicated print window that calls print automatically. A staff member who almost creates a duplicate link instead sees "this patient has 1 active share link" and simply forwards the same PIN again.

Expiry, PIN, QR and email, one dialog, ten seconds.

Presets of 7, 14, 30 or 90 days, or no expiry, an optional 4 to 6 digit PIN with a one-click random generator, and the link copies to the clipboard the moment it is created; emailing it straight to the patient uses the same contact-book autocomplete as everywhere else in the app. Ninety days, a random PIN, the patient's email, and the link is already in her inbox before anything has been copied by hand.

Bulk import

A dropped Wi-Fi connection resumes, it does not restart.

Uploads move in 5 MB chunks, three files at a time with two chunks each, up to six concurrent streams, and a SHA-256 hash of the whole file runs a dedup check before any bytes move. A technician drags in a 12 GB folder and loses Wi-Fi halfway through; back online, the upload picks up from the interrupted chunk instead of starting the whole folder over, with a live speed and time-remaining readout the whole way.

Drag in a whole folder, junk and all, and only the real files land.

A recursive tree walk reads nested folders the browser's plain file API would return empty for, and a deny-list quietly strips .DS_Store, Thumbs.db, desktop.ini and other OS junk rather than filtering by file extension, because DICOM files off an old CD often have none. An archivist drags in a folder copied straight from a decade-old disc and only the real images import.

The same disc twice never becomes two copies of the study.

A SHA-256 hash of the raw uploaded file catches an exact repeat of the same package, and Orthanc's own SOPInstanceUID check separately catches the same DICOM content repackaged differently; the cache only remembers a file as "already have it" once every instance from it actually landed. An archivist reloads the same USB stick a month later, having forgotten it was already imported; the precheck says so instantly and not one image duplicates.

The timeout for a stalled import is sized to a real clinic's internet, not a guess.

A job that never started processing gets reaped after 30 minutes; one already making progress gets a full 60 minutes, deliberately sized around a measured median clinic uplink of 8.7 Mbps, where a 4 GB ISO can legitimately take close to an hour. A technician starts a large upload on a weak connection and goes to lunch; the job survives because it is still genuinely, if slowly, moving.

Gateway and multi-site

A branch clinic with no static IP is online in two minutes.

Adding a node returns a one-time key plus a ready PowerShell one-liner, a Docker Compose command, and a downloadable installer; rename, pause, rotate the key or delete are all one click, and the table shows online status, agent version, queue depth and free disk space, refreshed every 10 seconds. An admin clicks Add Node, pastes the command on the branch's computer, and ten seconds later the node shows Online with real free disk space, no developer involved.

A study that keeps failing gets quarantined, not retried forever.

The local spool moves a file through five states, incoming, pending, uploading, done or failed, and dead-letter, backing off 60 seconds times two to the power of the attempt number; after three failed attempts it stops retrying and sets the study aside instead of hammering a dead connection indefinitely.

Both directions of PACS connectivity are self-service.

A card at the top hands over this instance's own AE Title, IP, port and protocol for external senders; below it, full control over outbound nodes includes a one-click C-ECHO test with a freshness dot that turns yellow once the last echo is over 10 minutes old. A partner clinic asks where to send images; the admin copies the AE Title, IP and port block off the screen and emails it, no IT call needed.

A compromised local login still cannot read the spooled images.

The installer strips folder inheritance and removes the broad local-user groups from the Windows ACL on the agent's data directory, leaving only the system account and administrators with access. A front-desk computer running the gateway under an ordinary, unprivileged login stays that way; even if that login is compromised, it still cannot read another patient's images off disk.

DICOM core

A slow connection pulls roughly half the bytes, math-lossless.

When a viewer does not pin its own transfer syntax, the archive transcodes to JPEG 2000 Lossless on the fly, measured at 149 KB down to 55 KB on one MR instance, a 63 percent cut, and about 4.2 MB down to 1.5 MB on a 28-slice series. This is the already-shipped J2K path, not the still-parked HTJ2K format, and the two are never the same claim. A radiologist on a 9 Mbps rural connection opens an MRI using roughly half the bytes the original transfer syntax would have sent.

A worked-around viewer bug turns 22 seconds of disk reads into 50 milliseconds.

Study-level metadata stays set to a fuller mode because the lighter alternative hangs a known OHIF bug, but series-level metadata deliberately runs the lighter mode instead, which measured 22 seconds of disk reads down to about 50 milliseconds served straight from the index on a 295-instance series. A second radiologist opens the same 295-slice series five minutes later; the metadata comes from memory, not disk.

A 50-study grid weighs kilobytes, not 27 megabytes.

Four cache layers land on a 96px WebP thumbnail at quality 70, 2 to 5 KB each, versus the 1 to 2 MB PNGs Orthanc generates natively; unresized, the same 50-study page measured 27 MB and hung the connection for about 20 seconds. A backfill job populated 850 studies of thumbnails in about 3.5 minutes, measured. A radiologist scrolling a busy worklist never sees that lag.

Patient-friendly folder names come out of a raw streamed archive.

A byte-level filter rewrites the DICOM caret in a name like NGUYEN^LILY^M to a plain space while the ZIP streams straight from the archive to the browser, no buffering, no repacking, and it fails open: an unfamiliar structure just leaves the caret in place rather than risk a corrupted file. A patient unzips a downloaded study and the folder reads "NGUYEN LILY M," not the raw DICOM caret format.

Admin and RBAC

Seventeen permissions, four roles, one toggle each, no redeploy.

Rights split across clinical, sharing and administration groups apply to admin, doctor, technician and viewer roles; the admin role itself is not stored in the database at all, so it physically cannot be edited into a lockout. A clinic owner decides technicians should not see Contacts anymore, flips one toggle, and the next technician who logs in simply does not have that menu item.

Revoking one employee's access kills every open tab that same second.

A role change, a block, a password reset or an explicit revoke all bump the same version counter behind the scenes, and every tab that employee had open gets rejected on its very next request. Separately, the system will not let itself end up with zero working admins; demoting or blocking the last one is refused outright. A front-desk employee quits on a Friday evening; the admin clicks Revoke Tokens, and every tab that employee had open drops the same second.

Block, revoke or delete any one account, never your own.

Per-row buttons handle edit, block, revoke tokens and delete, and all four are disabled on the logged-in admin's own account, so a tired 2 a.m. mistake cannot lock the clinic's only administrator out of their own system.

Any external viewer is one URL pattern away, no code required.

An admin adds a viewer by name, description and URL scheme, with placeholders for the study's UID, its internal ID and the request's own origin filled in automatically at runtime; logos ship ready for eight known viewers, OHIF, Stone, OsiriX, Horos, RadiAnt, 3D Slicer, MicroDicom and PostDicom. A radiologist insists on RadiAnt; the admin adds it in under a minute and "Open in RadiAnt" appears on every study's action menu from then on.

Made yours

Customization is part of the setup engagement, not a separate line item: the system gets adjusted to the clinic's actual workflow instead of the other way around, and a feature request goes straight to the engineer who builds both products, not a committee or a change-order process. White-label and partner arrangements exist for integrators who want their own name on the front end, detailed on partners. Both products carry the clinic's own identity throughout, not a vendor's portal branding sitting between staff and patients.

Audit and retention

Even a stolen database password cannot rewrite a sealed audit row.

A database trigger blocks every update and delete on the audit log outright; deletion is possible only when a specific session flag is explicitly set, and only one internal routine ever sets it, inside a single transaction. Someone who obtained the database credentials directly tries to delete rows straight from the database console; the trigger rolls the operation back because that flag is not set, direct database access does not help.

One button mathematically proves the log has not been touched.

"Verify integrity" recomputes the entire hash chain and returns either "chain intact, N rows verified" or the exact sequence number where it broke and why. After a suspected breach, an admin clicks it and gets "verified 48,213 events, every hash link intact" within seconds, enough to tell a regulator the log was not altered.

Deleting old audit rows first requires proving you already exported them.

Pruning history past the retention window demands the exact cryptographic hash of a fresh export of that range; a mismatch, or a chain that does not verify, refuses the deletion outright, no override. A compliance officer clearing a year-old retention window cannot accidentally delete the wrong range; the system will not allow it without the matching checksum in hand.

"Who looked at my records" answered in one export, not a manual search.

A dedicated per-patient access report pulls every study, series and share-link view for that one patient in a single call, classifies each as clinic staff or an outside guest, and exports up to 10,000 rows as a CSV. A patient formally requests who looked at their chart in the last year; the front office opens that patient's access history and hands over a complete answer in one export, not a manual search through the general log.

Backups and ops

A compromised web container still cannot touch backups or the host.

The backend can only write a row asking for a backup; a separate process running directly on the host, not inside any container, claims that request once a minute and is the only thing that ever runs the actual backup script. Even if the whole application container were compromised through a dependency vulnerability, the attacker has no path to the Docker daemon and no way to stop backups or wipe a volume.

A failed update rolls itself back and proves the rollback worked too.

Before any update, a backup runs automatically; after the update, three smoke tests check the backend, Orthanc and the frontend, and if any one fails the system checks out the previous version, rebuilds, and must pass all three tests again before it is considered recovered. A nightly beta update pulls a broken migration; the smoke test catches it, and by morning the stack is healthy again on the old version, no one paged.

The restore drill is proven safe by runtime checks, not a naming convention.

Before every drill, the code itself asserts the drill's project name and volumes are not the production ones, checks a disk-space margin against the real archive size, and locks against a second drill running at the same time; the verifier then checks the database restored cleanly and that Orthanc's counts match the manifest to a 0.98 threshold. A Sunday 3:30 a.m. timer and a manual click from the UI at 3:31 both try to run a drill at once; the second one gets "another restore-drill is already running" instead of corrupting the first.

Three separate recovery paths, none of them need a phone call.

An interrupted import marks itself errored on restart and resumes only the missing part by hash; a C-STORE transfer left mid-flight gets a watcher re-attached automatically, polling every 2 seconds for up to 30 minutes; a gateway agent that lost power mid-upload moves every stuck file back to pending the moment it restarts. Power cuts at a branch office mid-transfer; when it comes back, the agent finds the incomplete files on its own and resumes exactly where it left off, nothing lost, nothing duplicated.

Security and crypto

For the full posture, including the HIPAA framing, see security.

The backend physically will not start with a public, default password.

If the signing key or the Orthanc password still match the placeholder string shipped in the public example configuration, the process exits immediately with a clear error rather than quietly running exposed. A new operator forgets to fill in the environment file; instead of booting with a publicly-known key, the container refuses to start at all.

Backups are encrypted with real parameters, not a token gesture.

Every backup runs through AES-256-CBC with PBKDF2 at 100,000 iterations before it touches disk, and an unencrypted backup is not a state the tooling allows in the first place.

A guessed study link still gets rejected, even past the app itself.

A guest's viewer token is checked against the exact patient the share belongs to, so guessing a different study outside that share returns a flat 403 even with a valid guest token; bulk-export routes are blocked a second time at the reverse-proxy layer, so even a direct call that skips the application entirely still gets refused. A read-only account that mistakenly receives a direct archive link from a colleague gets 403 before the request ever reaches the archive.

Nothing is exposed to the internet except the one DICOM port.

In production, the database, the cache and the backend accept no external connections at all; the archive publishes exactly one inbound port, for C-STORE and C-ECHO, and the web app itself sits behind a tunnel rather than an open port. TLS on that DICOM port is available and gets switched on during setup when a modality actually calls for it; it is not a background default we advertise as already running everywhere.

Vendo: clinical safety gates

Vendo is the referral portal, FHIR-native, built on Medplum, and it runs alongside MiniPACS rather than bolted on top of it. Here is the whole thing, not a highlight reel.

Ordering contrast on failing kidneys gets a hard stop, not a warning.

An eGFR under 30 blocks a contrast MRI order on both the referring physician's and the clinic's own submission paths, and the field is required the moment contrast is selected. A technologist marks "MRI with contrast" for a patient with an eGFR of 22; the portal refuses the submission with the exact clinical reason instead of the clinic discovering the problem on the day of the scan.

Pregnancy does not block an X-ray, but it does demand a written reason.

Marking a patient pregnant on an X-ray order requires a documented clinical reason before the order can proceed, and that reason gets written permanently into the record. An orthopedist still orders a foot X-ray after a fall, entering the shielding and fracture-risk reasoning; the decision stays the physician's, but it is now on the chart instead of lost in a phone call.

Allergy and contrast-reaction answers are captured fresh every visit.

Up to 500 characters plus a yes, no or unknown answer on prior IV-contrast reactions gets stored against that specific referral, not the patient's static profile, so a new answer never silently overwrites an older one. A patient had no reaction six months ago but has had one since; the next referral captures the new answer without erasing the earlier record.

Naming another clinic's patient does not grant access to their chart.

When a referral names an existing patient by ID, the server re-checks that the requesting physician can actually access that specific patient before proceeding, closing a specific cross-tenant hole rather than relying on the form's own honesty. A dishonest account tries substituting a competing clinic's patient ID; the portal rejects it before any record is even created.

Vendo: scheduling that does not lie

Two clicks on the same slot, only one of them wins.

Claiming an appointment slot is an atomic, conflict-safe write with an automatic rollback if the rest of the booking then fails, and slot writes run through a dedicated service account rather than the referring physician's own, after an internal review found that grant could otherwise delete an entire clinic's calendar. Two physicians click the same Thursday 2 p.m. slot at the same instant; the loser sees "that time is no longer available" instead of both believing they had booked it.

Free time is math, not rows that need cleaning up.

Available slots are computed on the fly from working hours minus what is actually booked, up to 400 days ahead; a real appointment record is created only at the moment of booking. An admin shortens clinic hours on a Friday, and the evening slots simply stop existing on the next query; nothing needs bulk deletion.

9 a.m. stays 9 a.m. across a daylight-saving change.

Local-to-UTC conversion iterates through the actual timezone rules until the round trip matches, rather than doing naive offset math that breaks twice a year. A clinic generates slots spanning the March time change; patients who booked in advance still see 9 a.m., not an hour of drift.

Vendo: pipeline and referrer relationships

Fixing a typo does not have to reopen a closed case.

Raw record edit changes a field directly with no side effects, no email, no slot movement, and quietly logs exactly what changed, hidden from the referrer. Front desk notices a date-of-birth typo after the report is already sent; they fix it in ten seconds with no reopening and no notification email.

Deactivating a referrer does not erase their referral history.

Deactivation cuts off access immediately but keeps the practitioner's record and referral history intact; reactivation later reconnects the same profile without duplicating a single chart. A clinic parts ways with a referrer, then reconnects months later when that physician joins a different practice, and nothing gets duplicated.

A digest that names the referrer going quiet, not just the numbers.

Up to eight plain-English lines flag what actually needs attention that week, referrals overdue, a modality nearly fully booked, and it separately flags a referrer who just went quiet after a run of activity. "Dr. Park went quiet after 6 referrals last week" shows up in a Monday email long before that drop would show up in a quarterly report.

Vendo: access and branding

A one-tap sign-in link, honestly not a second factor.

A signed link with a 30-minute expiry and a single use lets a staff member text or email a referring physician a way in instead of a password to fumble; it dies fast on purpose, because an intercepted link is mostly stale by the time anyone could use it. To be precise about what it is not: Vendo has no two-factor authentication today, the account page itself marks it "Coming soon," and a magic link is an alternate way to sign in, never a second factor stacked on top of one.

A full white-label result in minutes, no code touched.

Eight accent colors across light and dark, times four neutral tones, cover the whole interface from the login screen to outbound email. An agency stands up the portal for a brand-new clinic in ten minutes, picks a color pair in settings, and every screen looks like a distinct brand with nothing hand-coded.

The combination

One referral-to-read pipeline, one vendor to call.

A referral that already passed Vendo's eGFR, pregnancy and allergy gates, and is already scheduled, shows up as a study in the MiniPACS worklist the moment images land, with that clinical context already attached. Two disconnected systems a clinic would otherwise reconcile by hand become one.

The same hard engineering pattern, independently, in both products.

Optimistic concurrency on writes, host-level isolation for anything destructive, and a real audit trail sit in both MiniPACS and Vendo, not because one team copied the other, but because both independently converged on the same discipline for handling a clinical record.

Under the hood

Orthanc 26.4.2, not a fork frozen years ago.

The DICOM engine underneath is the current Orthanc 26.4.2 build, the same open-source core that handles C-STORE, C-ECHO and DICOMweb, kept current rather than pinned to whatever shipped at launch.

Postgres 16 holds the index, with real row-level locking under load.

The archive's images stay on disk; Postgres 16 holds only the searchable index, and job claims, both the gateway's and the backup system's, use a row-level lock that skips already-claimed rows, so two workers polling for work at the same moment can never grab the same one.

Redis serves the last good answer through a hiccup, not a failure.

Query results cache in Redis with a deliberate stale-while-error design: each entry's outer expiry runs ten times longer than its real freshness window, so a Redis blip mid-shift serves the last known answer instead of failing the request outright; if Redis is absent entirely, the exact same code path falls back to an in-memory cache with no behavior change.

React 19 and FastAPI on the app side, real FHIR on Vendo's.

The frontend runs React 19, the backend runs FastAPI, both current, not legacy holdovers kept alive out of inertia. Vendo's referral and scheduling data lives as actual FHIR resources on Medplum, not a custom schema translated into FHIR-shaped JSON after the fact. MiniPACS installs as one Docker stack on Linux; Vendo's own hosted infrastructure, networking, the database, the Medplum stack, observability, is provisioned as versioned Terraform modules, not clicked together by hand in a cloud console.

Landing next

Two things are named here on purpose instead of quietly left off the page. DICOM Modality Worklist is not in the product today; there is no C-FIND SCP for procedure scheduling to modalities, and this page says so rather than letting the absence go unmentioned. Two-factor login for Vendo is not live either, its own account page already marks it "Coming soon," in the product's own words, not ours. Everything else described on this page is clickable in the live demo today, and that line does not move until a feature has actually shipped, not when it is merely planned.

What is not here

No HL7 of any version, and no DICOM storage commitment. Clinics that depend on a hospital RIS integration over HL7 are not the fit for this system today, and that is worth knowing before you evaluate it, not after. See teleradiology PACS and HL7 for where that line sits and what to look for instead.

There is also no anonymization or de-identification feature. The protection on patient data here is the access control and audit trail described above, not a pipeline that strips identifiers from a study before it leaves the building; if a workflow needs de-identified images out the door, that step happens outside MiniPACS today. And the interface itself is English only; there is no language switcher or localized date formatting anywhere in the product.

Judge the interface yourself

We think it is the best-looking PACS you will meet at any price, but that is a claim you should verify, not take on our word. The live demo is one click; the whole arsenal above is in it, running on synthetic data. For the deployment model in more depth see self-hosted PACS, or start from the landing page for pricing and the demo button.

FAQ