Medical Image Sharing for Lawyers: Requests, Chain of Custody, and Evidence

In personal injury and medical malpractice cases, imaging is often the most objective evidence of harm. An MRI showing a herniated disc, a CT showing a skull fracture, or a missed finding on a prior scan can shape liability, damages, and settlement value.

Getting that imaging, keeping it intact, and presenting it well is harder than requesting paper records. Studies are large, they arrive in a medical file format, and they are protected health information. This guide explains how attorneys and their staff can lawfully request images, receive and review them, preserve their integrity, and use them as evidence.

This article is general information, not legal advice. Rules vary by state and court, so confirm the requirements in your jurisdiction.

Why imaging matters in injury and malpractice cases

• It shows the injury. A fracture line, a torn ligament, or a brain bleed is easier for a jury to understand than a description in a chart note.
• It helps date the injury. Some findings suggest a recent injury, while others point to long-standing degeneration. Comparing new scans with prior ones is often central to causation arguments.
• It supports damages. Follow-up imaging can show healing, worsening, or the need for future surgery.
• It is the core evidence in many malpractice claims. Missed or delayed diagnoses often turn on what a prior study showed and what the original report said.

The written radiology report matters, but so do the images themselves. Opposing experts will review the original studies, so your team should have the same complete set of studies.

Common injuries and the imaging that documents them

Injury	Imaging usually used	What it can show
Fractures	X-ray first; CT for complex or hidden fractures	Fracture lines, displacement, healing over time
Spinal injuries (neck and back)	MRI for discs, nerves, and ligaments; CT for bone	Disc herniation, nerve compression, ligament injury, fractures
Traumatic brain injury	CT in the emergency setting; MRI later	Bleeding, swelling, and some injuries CT can miss
Knee, shoulder, and other joint injuries	MRI	Ligament, tendon, meniscus, and cartilage tears
Foot and ankle injuries	X-ray; MRI or CT for subtle fractures and ligaments	Stress fractures, ligament tears, joint injury
Soft tissue and internal injuries	Ultrasound, CT	Tendon tears, fluid collections, organ injury

Many cases involve several modalities over months. Reviewing them together, in date order, shows how the injury evolved, and is far easier with the full studies than with individual reports.

How to request medical images lawfully

Medical images are protected health information (PHI) under HIPAA. A disclosure to an attorney is not a treatment disclosure, so the provider needs a lawful basis to release the images. There are four common paths.

Path	Who starts it	When it fits	Watch for
Patient authorization	Your client signs a HIPAA authorization naming your firm	Your own client’s records	The form must contain the required elements, or the provider will reject it
Patient right of access	Your client requests their own images	Fast, often cheapest route for your own client	The client can receive the copy and pass it to you, or direct it to you
Subpoena or discovery request	Your firm, in litigation	The opposing party’s records, or when the provider will not act on an authorization	The provider needs satisfactory assurances: notice to the patient, or a qualified protective order
Court order	The court	Contested or sensitive records	The provider may release only what the order expressly covers

Patient authorization

A valid HIPAA authorization must describe the information to be disclosed, name who may disclose it and who will receive it, state the purpose, include an expiration date or event, and carry the patient’s signature and date. It must also tell the patient they can revoke it in writing. A vague request such as “all records” may be accepted, but asking specifically for “all imaging studies in DICOM format, with reports, from [date] to [date]” avoids getting only the written reports.

Patient right of access

Patients have a HIPAA right to copies of their own images. The provider must respond within 30 days, with one 30-day extension allowed, and must provide an electronic copy in the format requested if it is readily producible. Your client can also direct the provider to send the copy to your firm. Fee limits that apply when patients request their own copies do not extend to copies sent to third parties; since a 2020 federal court ruling, state law largely governs those fees. Our guide to HIPAA-compliant medical image sharing covers the provider’s side of these rules.

Subpoenas and court orders

Under HIPAA, a provider may disclose PHI in response to a court order, limited to what the order expressly authorizes. For a subpoena or discovery request without a court order, the provider must first receive satisfactory assurance that the patient was notified and given a chance to object, or that the parties have sought a qualified protective order. Many records departments will not release images on a subpoena alone, so include these assurances with the request.

What to ask for

• The complete studies in DICOM format, not screenshots, JPEGs, or a PDF of key images.
• The final radiology report for each study, plus any addenda.
• Prior studies of the same body area, which are often vital for causation.
• Electronic delivery via a secure link when offered by the provider, with a CD as a fallback.
• A certification from the records custodian if you may need to authenticate the records later (see below).

Receiving and reviewing imaging studies

Understand what you received

Medical images are stored in the DICOM format, the standard for medical imaging. A single MRI study can contain several series and hundreds or thousands of images, each with a header that records details such as the patient, the facility, the scanner, and the exam date. A DICOM study opens in a DICOM viewer, not in an ordinary photo or PDF reader.

Before relying on a study, check that:

• The patient name and identifiers match your client.
• The study date and body part match the request.
• Every series listed in the report is present.
• The final report, not a preliminary one, is included.

The trouble with CDs

Many providers still send studies on CDs. They are slow to arrive, often require an outdated viewer on the disc, may not open on modern laptops without a disc drive, and can be lost or damaged. A lost unencrypted disc also exposes your client’s PHI. Ask for electronic delivery first, and if you receive a CD, copy the study to secure storage on arrival and keep the disc itself as received.

Viewing studies

A browser-based DICOM viewer lets legal teams open studies without installing software, scroll through series, compare dates side by side, and take basic measurements. For case work, look for a viewer that:

• Opens full studies from any modality, including CT, MRI, X-ray, and ultrasound.
• Shows several studies side by side for before-and-after comparison.
• Lets you share view-only access with co-counsel or experts, with an access log.
• Exports key images for exhibits while keeping the original study unchanged.

A viewer helps you navigate and present images. It does not replace a radiologist’s interpretation.

Getting an independent radiology review

Attorneys should not interpret images themselves. A board-certified radiologist, ideally a subspecialist in the relevant area, can review the full studies, compare them with prior scans, and explain what is acute and what is long-standing. This review may support case evaluation, expert testimony, or a rebuttal of the opposing expert. Our guide to the radiology second opinion process explains how independent reads work.

The quality of that written material matters as much as its availability. When a small communications team has to produce education pages for dozens of conditions, AI-assisted drafts tend to come back in the same flat, generic register, and patients notice when guidance reads like a manual rather than like their own clinic. Running those drafts through an ai humanizer keeps the clinician’s own phrasing and the practice’s tone intact while the volume gets handled. Clinical review of the content stays exactly where it already sits in the workflow.

How images move between providers, attorneys, and insurers

1. The imaging center or hospital performs the scan and stores it in its PACS.
2. The treating doctor receives the report and, often, the images.
3. The attorney requests the studies through one of the lawful paths above.
4. The attorney shares them with a reviewing radiologist or expert.
5. Relevant studies are produced to opposing counsel or the insurer in discovery.
6. Selected images become exhibits at deposition, mediation, or trial.

Every handoff is a chance for delays, missed series, or privacy breaches. Electronic sharing with access controls and logs reduces all three.

Chain of custody and integrity

Opposing counsel may challenge whether a study is complete and unaltered. The DICOM format itself does not prevent changes: header fields such as names and dates can be edited with common software, and images can be removed from a series. Integrity comes from how the study is handled, not from the file type.

Good practice for a firm that handles imaging:

• Keep the study exactly as received. Store the original files, or the original CD, separately from any working copies.
• Record receipt. Log who sent the study, how it arrived, the date and time, and what it contained (number of studies, series, and images).
• Fingerprint the files. Generating a cryptographic hash, such as SHA-256, upon receipt lets you later show that the files have not changed.
• Work from copies. Annotate, export, and crop only on copies, and keep exhibits traceable to the original study.
• Control and log access. Share studies with experts and co-counsel via access-controlled links, and maintain an access log.
• Request a custodian certification. A certification from the provider’s records custodian is often the simplest way to establish the origin of the records.

Using imaging as evidence

Rules differ between federal and state courts, but the federal framework shows the questions you will need to answer.

• Authentication: under Federal Rule of Evidence 901, you must show the images are what you claim they are, for example, through a witness from the provider or the records’ distinctive characteristics.
• Business records: imaging studies and reports made in the regular course of a provider’s business may fall within the hearsay exception under FRE 803(6).
• Self-authentication: under FRE 902(11), certified domestic business records can be admitted with a written certification from the custodian and advance notice to the other side, without a live witness.
• Copies: under FRE 1001 to 1003, an accurate electronic copy or printout can generally be used unless there is a genuine question about authenticity or fairness.

In practice, attorneys usually present key images rather than full studies: a few slices with the finding, side-by-side comparisons over time, or annotated exhibits explained by a radiologist. Keep every exhibit traceable to the full original study, because the opposing expert will review it.

Working with medical teams and insurers

• Treating physicians can explain imaging in context, but they may not be radiologists. For contested findings, pair them with a radiologist.
• Insurers and defense counsel will request the same studies. Producing complete, organized studies early helps avoid disputes over missing images.
• Independent medical examinations often include their own imaging review. Make sure your expert has every study the examiner saw.
• In malpractice cases, the original images and the original report at the time of the read are both critical. Ask for the report version history and any addenda.

Does HIPAA apply to law firms?

A law firm that receives a client’s records under an authorization is usually not a HIPAA covered entity, so HIPAA does not directly govern how the firm stores them. A firm that represents a hospital or health plan and handles its PHI is different: it is typically a business associate and must sign a business associate agreement.

Either way, firms are not free of obligations. Protective orders, state privacy and data breach laws, and professional duties of confidentiality and competence all apply. Treat imaging with the same care a provider would: encrypted storage and transfer, access limited to the case team, and a record of who opened what.

Best practices for attorneys handling imaging

1. Request imaging early, with priors, in DICOM format, using the lawful path that fits.
2. Ask for electronic delivery and avoid CDs where possible.
3. Log receipt, fingerprint the files, and keep originals separate from working copies.
4. Share with experts and co-counsel through access-controlled links, not email attachments or consumer file-sharing accounts.
5. Get an independent radiology review for any contested finding.
6. Build exhibits from copies, traceable to the original study.
7. Request custodian certifications in time for trial deadlines.
8. Set a retention and destruction policy that matches your protective order and state rules.

Choosing a platform to share imaging

Ask	Why it matters
Can recipients open full DICOM studies in a browser, without installing software?	Experts, co-counsel, and mediators can review quickly.
Can providers upload studies to you directly, and can you upload a CD?	Covers both electronic and disc-based delivery.
Can you share view-only access that expires or can be revoked?	Limits exposure when a case ends or a team changes.
Is every view, download, and share logged?	Supports chain of custody and privacy obligations.
Is data encrypted in transit and at rest?	Protects PHI and meets protective order expectations.
Will the vendor sign a business associate agreement if you need one?	Required when you handle PHI for a covered entity.
Can you export key images without changing the original study?	Keeps exhibits traceable.

For more on the standards behind provider-to-provider exchange, see our guide to how medical image sharing works.

Where Medicai fits

Medicai is a medical imaging platform, not a legal service or a radiology reading service. It does not interpret images or provide legal advice.

With the Medicai Medical Imaging Exchange, providers can share full DICOM studies through secure links, and legal teams can open them in a web browser without installing software or handling CDs. To see how it works for law firms, visit the Personal Injury Lawyers solution page.

Frequently asked questions

How do I get my client’s MRI or CT images for a personal injury case?

Have your client sign a HIPAA authorization naming your firm, or have them request the images under their right of access and direct the copy to you. Ask for the complete studies in DICOM format, the final reports, and any prior studies of the same area, delivered electronically where possible.

Can a medical provider release images to an attorney without the patient’s consent?

Only in limited cases. A provider can release images in response to a court order, limited to what it covers, or a subpoena accompanied by satisfactory assurances that the patient was notified or that a qualified protective order was sought. Otherwise, the patient’s authorization is needed.

Is the radiology report enough, or do I need the images?

Get both. The report states the radiologist’s conclusions, but experts on both sides will review the images themselves. Without the full studies, you cannot check the findings, compare them with prior scans, or prepare exhibits.

How do I open DICOM files from a CD?

Copy the files to secure storage first, then open them in a DICOM viewer. Many discs include a viewer that may not run on newer computers. A browser-based viewer, or asking the provider for an electronic copy instead, is usually easier.

Can DICOM images be altered?

Yes. Header details such as names and dates can be edited, and images can be removed from a series. That is why firms should keep the original as received, record a file hash at receipt, work only from copies, and keep an access log.

Are medical images admissible as evidence?

They often are, but admissibility depends on the court’s rules and the facts. In federal court, imaging records are commonly admitted as business records under FRE 803(6), authenticated under FRE 901 or by a custodian certification under FRE 902(11). Confirm your jurisdiction’s rules.

Does HIPAA apply to my law firm?

Usually not directly when you receive your own client’s records under an authorization. It does when your firm handles PHI on behalf of a covered entity, such as a hospital client, as a business associate. Protective orders, state privacy laws, and professional duties apply either way.

Sources

• 45 CFR 164.508, Uses and disclosures for which an authorization is required, eCFR
• 45 CFR 164.512(e), Disclosures for judicial and administrative proceedings, eCFR
• Individuals’ right of access under HIPAA, HHS
• Federal Rule of Evidence 803, Cornell Legal Information Institute
• Federal Rule of Evidence 901, Cornell Legal Information Institute
• Federal Rule of Evidence 902, Cornell Legal Information Institute
• Federal Rule of Evidence 1003, Cornell Legal Information Institute