PACS Connectivity Guide

How to Connect an iPhone/iPad DICOM Viewer to PACS (DICOMweb)

Updated July 2026 · 8 min read

Pulling a study straight from the PACS to an iPad is the difference between a mobile viewer being a toy and being a working tool. Emailing ZIP archives or burning CDs works for one-off referrals, but for daily use you want the iPad to query the archive directly. The mechanism that makes this practical on iOS is DICOMweb — and MedScan implements it natively with QIDO-RS search and WADO-RS retrieval, against servers like Orthanc and dcm4chee.

DICOMweb in Two Minutes: QIDO-RS and WADO-RS

Classic PACS communication uses the DIMSE protocol — C-FIND to search, C-MOVE to retrieve, C-STORE to send. It dates from the early 1990s: binary messages on dedicated TCP ports, with the archive expected to open a connection back to the requesting device. That last part is the killer on mobile. A phone on Wi-Fi or cellular has no stable inbound address, so C-MOVE simply cannot deliver to it.

DICOMweb solves this by recasting the same operations as RESTful web services over HTTPS:

QIDO-RS

Query based on ID for DICOM Objects

Search. GET requests against /studies, /series, /instances with filters like PatientName, StudyDate, Modality. Returns DICOM attributes as JSON.

WADO-RS

Web Access to DICOM Objects

Retrieve. GET a whole study, a series, or a single instance as multipart DICOM. This is how the pixel data reaches your iPad.

STOW-RS

Store Over the Web

Upload. POST DICOM objects to the archive. Relevant for round-tripping exports back to the PACS.

Because it is ordinary HTTPS, DICOMweb traverses firewalls, reverse proxies, and VPNs like any other web traffic, and the client never needs an inbound port. That is exactly the profile a mobile viewer needs, which is why MedScan uses QIDO-RS + WADO-RS for its PACS import.

Server Side: Orthanc and dcm4chee

If your institution already runs a commercial PACS, ask the administrator whether a DICOMweb endpoint is available — most modern archives ship one, sometimes as a separately licensed gateway. If you are setting up your own archive (a private practice, a dental clinic, a research group), two open-source servers cover almost every case:

Orthanc is the lightweight choice — a single small server that runs on anything from a Raspberry Pi to a clinic NAS. Enable the official DICOMweb plugin and the endpoint appears under /dicom-web (e.g. https://pacs.example.com/dicom-web). Orthanc handles Basic auth itself via registered users, or you can put it behind a reverse proxy for TLS and OAuth2.

dcm4chee Arc is the heavyweight — a full enterprise archive with DICOMweb enabled out of the box. Its default base path looks like /dcm4chee-arc/aets/DCM4CHEE/rs, and it integrates with Keycloak for OAuth2, which pairs naturally with MedScan's OAuth2/PKCE support.

In both cases the value you ultimately need for the client is the DICOMweb base URL — the prefix in front of /studies. A quick sanity check from any browser: open <base-url>/studies?limit=1. If you get JSON (or an auth challenge), the endpoint is alive.

Authentication: Basic Auth vs OAuth2/PKCE

Never run an unauthenticated DICOMweb endpoint outside a strictly isolated network. MedScan supports the two authentication schemes that cover real deployments:

HTTP Basic auth — username and password sent with every request over TLS. Simple, supported natively by Orthanc and most proxies. Appropriate for small practices and single-user setups; always combine with HTTPS.
OAuth2 with PKCE — the modern standard for native apps. The app opens the identity provider's login page (e.g. Keycloak in a dcm4chee deployment), the user signs in, and the app receives short-lived tokens. PKCE means no client secret is baked into the app, and tokens can be revoked centrally — the right choice for hospital environments with central identity management.

For remote access, the safest pattern remains a VPN into the clinic network with the PACS itself never exposed publicly; DICOMweb works over the tunnel unchanged.

Step-by-Step: Connecting MedScan

1. Add a server. In MedScan, open the import screen and choose PACS / DICOMweb. Create a new server entry.

2. Enter the base URL. Paste the DICOMweb base URL from your administrator or your Orthanc/dcm4chee setup — including the path prefix, e.g. https://pacs.clinic.example/dicom-web.

3. Configure authentication. Pick Basic auth and enter credentials, or pick OAuth2 and complete the sign-in flow in the browser sheet (PKCE is handled automatically).

4. Search. Query by patient name, ID, study date, or modality. MedScan issues QIDO-RS requests and lists matching studies with series counts.

5. Retrieve. Tap a study to pull it via WADO-RS. Once downloaded it is stored locally — from that moment everything works fully offline: MPR, 3D volume rendering, measurements, annotations, no further network access needed.

Studies imported from PACS behave exactly like ones imported from a DICOM CD or a ZIP archive — same tools, same on-device privacy model, no account, no cloud upload.

Troubleshooting Checklist

Connection refused / timeout: Confirm the device is on the same network or VPN as the PACS, and that the base URL includes the correct scheme, port, and path prefix. Test <base-url>/studies?limit=1 in Safari on the same device.
401 / 403 errors: Credentials wrong, token expired, or the account lacks DICOMweb permissions. In dcm4chee/Keycloak, check the client roles; in Orthanc, check the registered user.
Search works, retrieval fails: A reverse proxy stripping or blocking multipart/related responses, or a body-size limit smaller than your series. Raise proxy limits and check WADO-RS server logs.
Images retrieve but look wrong: Verify the transfer syntax. MedScan decodes JPEG 2000, JPEG Lossless, JPEG-LS, baseline JPEG, and RLE; a server transcoding to something exotic is the first suspect.
HTTPS certificate errors: Self-signed certificates need to be installed and trusted in iOS Settings, or replaced with a proper certificate (e.g. Let's Encrypt on the reverse proxy) — the better fix.

FAQ

What is DICOMweb and how is it different from classic DIMSE PACS?

DICOMweb is the web-services family of the DICOM standard: QIDO-RS for searching studies, WADO-RS for retrieving them, and STOW-RS for storing, all over plain HTTPS with JSON responses. Classic DIMSE (C-FIND/C-MOVE/C-STORE) uses a proprietary binary protocol on dedicated ports and requires the server to open a connection back to the client, which is impractical on mobile networks. DICOMweb behaves like any REST API, so it works through firewalls, reverse proxies, VPNs, and cellular connections — which is why MedScan uses it for PACS import on iOS.

Which PACS servers work with MedScan?

Any server that exposes a standards-compliant DICOMweb endpoint (QIDO-RS + WADO-RS). Orthanc (with its built-in DICOMweb plugin) and dcm4chee Arc are tested and work well. Commercial PACS from major vendors increasingly ship DICOMweb gateways too — ask your PACS administrator for the DICOMweb base URL.

Does MedScan support OAuth2 login to a PACS?

Yes. MedScan supports HTTP Basic authentication and OAuth2 with PKCE (Proof Key for Code Exchange). PKCE is the recommended OAuth2 flow for native mobile apps because no client secret has to be embedded in the app.

Are retrieved studies stored on the device?

Yes. Once a study is pulled over WADO-RS it is stored locally and everything after that — rendering, MPR, measurements — happens fully on-device and offline. Nothing is uploaded anywhere, and no account with MedScan itself is needed.

Can I connect over the internet, outside the hospital network?

Only if your PACS is deliberately published behind HTTPS with authentication (a reverse proxy with TLS, or a VPN into the network). Never expose a DICOMweb endpoint on the open internet without TLS and auth. Inside the LAN or over a VPN, a plain reachable base URL is enough.

MedScan finds studies but images fail to load. What is wrong?

That pattern means QIDO-RS works but WADO-RS does not. The usual causes are a reverse proxy that blocks the multipart/related content type used by WADO-RS, a too-small proxy body-size limit for large series, or a server that only offers a transfer syntax the client did not negotiate. Check the proxy configuration and the server’s WADO-RS logs first.