The FDA posted a Class II recall for a flaw in IntelePACS, the system where hospitals and imaging centers store X-rays, that could let an intruder act as an administrator. If you work in healthcare or get scans, those images could be altered, deleted, or locked away from the staff who need them.
You'll understand what a PACS is, what risk the notice describes, and what you can do to protect medical scans.
A flaw across 560 platforms
Five hundred sixty platforms of the same medical software have a security flaw. It's the software hospitals and imaging centers use to store X-rays and other scans. To see why that matters, it helps to look back. In 1895, Wilhelm Röntgen discovered X-rays and captured an image of his wife's hand. More than a century later, those images aren't films in an envelope anymore. They live in digital systems, and like any digital file, they need protecting too.
The hospital's archive and its master key
When you get a CT scan, the image goes into a PACS. That's the hospital's digital archive, with a viewer so your doctor can look at your scans. Almost everyone who uses it logs in as a regular user, and only a few hold the master key, which is the administrator account. The flaw is in IntelePACS, made by Intelerad, which the notice says is part of GE HealthCare. It could let someone take over an administrator's session.
What an intruder could do
The official notice doesn't explain how the trick would work. It does say an intruder could use an administrator's session as if they were that person. Think of finding the boss's key ring sitting on a desk. With that key, they could change or delete scans and images. Picture a CT scan that's simply gone when the doctor goes looking for it. They could also lock out the real users, leaving staff unable to see their patients' scans.
Nearly two months from fix to notice
Intelerad started correcting the flaw on September 10, 2026. On November 4, 2026, the FDA, the agency that oversees medical products in the United States, posted it as a Class II recall. The word recall can sound alarming, but here it means fixing the product, not shutting it down. Nearly two months passed between the start of the fix and the public notice, which lists 560 affected software platforms.
What we know and what we don't
In the meantime, Intelerad asked customers to keep using the system, but only with standard cybersecurity and access control practices. It also asked them to notify every user at each facility and send back an acknowledgment by form or by email. Some details remain unconfirmed. It hasn't been made public who discovered the flaw. There's also no final version of the fix published yet, since the notice only says the correction is in progress.
Who this notice is for
This affects hospitals and imaging centers running certain versions of IntelePACS. The FDA published the exact list of affected versions, from the program's 4 and 5 series. The notice doesn't describe anyone else as affected. It says nothing about your phone, your apps, websites, or other software. If your healthcare provider doesn't use IntelePACS, this recall doesn't mention it. The facilities running that software are the ones who need to act first.
Keep your scans in the right place
If you're a patient, the practical step is knowing where to get your scans. You request them from the center where you had them done, since that's where they're stored. It can be tempting to upload a CT scan or X-ray to an AI app so it can explain it to you. But doing that leaves your medical images somewhere you don't know who's looking. Your questions about a scan are better answered by your own provider.
Four rules to protect medical images
If you work in healthcare or get scans, these four rules help keep medical images safe.
An X-ray today is a file, and its safety depends on who holds the administrator's key.
Sources
Verified on November 11, 2026
Would you rather we handle it? Book a call