Sending CBCT scans to another practice safely (without breaching GDPR)

Sending a CBCT or intraoral scan to another practice by email or a free file-transfer site is one of those everyday habits that's quietly a data-protection problem. Dental imaging tied to a named patient is special-category health data — and most of the ways we send it weren't built for that.

I do this constantly — refer out for implants, oral surgery, complex endo — and the imaging has to go with the referral. So this isn't a lecture; it's the safer way I now do it myself.

Why the usual methods are risky

• Email — often not encrypted in transit, easy to send to the wrong address, and leaves copies sitting in multiple inboxes forever. One typo is a reportable breach.
• Consumer file-transfer (WeTransfer etc.) — convenient, but you've no control over who downloads the link, no audit trail, and the data sits on a third party's servers.
• USB / disc by post — slow, easily lost, and a nightmare to evidence if questioned.

What "safe" actually requires

• Encryption in transit and at rest.
• Access control — only the intended practice can open it, not anyone with a link.
• An audit trail — a record of what was sent, to whom, and when it was accessed.
• Capacity for real file sizes — a CBCT volume or full-arch scan can be hundreds of MB; email limits force people into the risky workarounds in the first place.

The practical default

The cleanest approach is to send imaging with the referral through one channel built for health data — so the scan, the notes and the audit trail live together, encrypted, with access limited to the receiving practice. That's exactly what AKPro Referrals handles (DICOM, PDF, STL and more, up to large CBCT files), but the rule holds whatever you use:

If you'd be uncomfortable explaining how a scan was sent to the ICO, don't send it that way.

Patients trust you with their most sensitive data. How it leaves your practice matters as much as the clinical decision behind it.