Wearing a fur coat in the summertime: Should digital pathology redefine medical imaging?

Abstract

Slides are data. Once digitized, they function like any enterprise asset: accessible anywhere, ready for AI, and integrated into cloud workflows. But in pathology, they enter a realm of clinical complexity—demanding systems that handle nuance, integrate diverse data streams, scale effectively, enable computational exploration, and enforce rigorous security.

Although the Digital Imaging and Communications in Medicine (DICOM) standard revolutionized radiology, it is imperative to explore its adequacy in addressing modern digital pathology's orchestration needs. Designed more than 30 years ago, DICOM reflects assumptions and architectural choices that predate modular software, cloud computing, and AI-driven workflows.

This article shows that by embedding metadata, annotations, and communication protocols into a unified container, DICOM limits interoperability and exposes architectural vulnerabilities. The article begins by examining these innate design risks, then challenges DICOM's interoperability claims, and ultimately presents a modular, standards-aligned alternative.

The article argues that separating image data from orchestration logic improves scalability, security, and performance. Standards such as HL7 FHIR (Health Level Seven Fast Healthcare Interoperability Resources) and modern databases manage clinical metadata; formats like Scalable Vector Graphics handle annotations; and fast, cloud-native file transfer protocols, and microservices support tile-level image access. This separation of concerns allows each component to evolve independently, optimizes performance across the system, and better adapts to emerging AI-driven workflows—capabilities that are inherently constrained in monolithic architectures where these elements are tightly coupled.

It further shows that security requirements should not be embedded within the DICOM standard itself. Instead, security must be addressed through a layered, format-independent framework that spans systems, networks, applications, and data governance. Security is not a discrete feature but an overarching discipline—defined by its own evolving set of standards and best practices. Overlays such as those outlined in the National Institute of Standards and Technology SP 800-53 support modern Transport Layer Security, single sign-on, cryptographic hashing, and other controls that protect data streams without imposing architectural constraints or restricting technological choices.

Pathology stands at a rare inflection point. Unlike radiology, where DICOM is deeply entrenched, pathology workflows still operate in polyglot environments—leveraging proprietary formats, hybrid standards, and emerging cloud-native tools. This diversity, often seen as a limitation, offers a clean slate: an opportunity to architect a modern, modular infrastructure free from legacy constraints. While a full departure from DICOM is unnecessary, pathology is uniquely positioned to prototype the future—to define a more flexible, secure, and interoperable model that other domains in medical imaging may one day follow. With support from forward-looking DICOM advocates, pathology can help reshape not just its own infrastructure, but the trajectory of medical imaging itself.

Introduction

While Digital Imaging and Communications in Medicine (DICOM) underpins nearly all medical imaging workflows and has historically proven effective, it now faces significant challenges aligning with modern security requirements, cloud-native principles, and contemporary software engineering practices.^1,2 Recognizing recent advocacy for DICOM as a guiding standard for pathology, this study proceeds in three steps: it first defines an analysis framework and identifies architectural cybersecurity risks within DICOM's design; then demonstrates how these risks surface in real-world interoperability challenges in digital pathology; and finally proposes a modular alternative.

Backdrop: DICOM advocacy at PathVisions 2024

At PathVisions 2024 in Orlando, the Digital Pathology Association's flagship annual conference, several speakers proposed DICOM as a universal guiding standard for digital pathology.³ One presenter compared it to international traffic signals, implying that just as drivers worldwide recognize a red light, pathologists everywhere could rely on DICOM's consistent cues. Yet this analogy, while appealing, inadvertently highlights a fundamental issue: traffic rules, like medical imaging standards, often vary according to local infrastructure, practices, and cultural norms.

The widely asserted “universality” of DICOM merits careful examination. In principle, it is a single standard; in practice, it often accommodates extensive flexibility through custom tags, locally adapted features, and vendor-specific configurations.² For instance, pathology and radiology file formats deviate significantly, rendering “interoperability” more of a controlled incompatibility. Vendors publish “DICOM Conformance Statements” to declare which parts of the standard they support—an implicit acknowledgment that no single product implements DICOM comprehensively. As Microsoft's Azure documentation candidly points out, “DICOM has remained at version 3.0 since 1993, with ongoing additions and revisions that introduce both breaking and non-breaking changes”, suggesting that what is often called standardization may function more as a patchwork of continually evolving, locally interpreted conventions.⁴

This predicament intensifies in digital pathology, where laboratory workflows and data complexity far exceed the scope of DICOM's original design.⁵ Decades ago, embedding patient information within image files ensured that images and critical data remained together—a sensible approach at the time. Other industries once relied on similar strategies, but have since adopted modular architectures built on modern data governance frameworks—enabling permissioning, encryption, auditability, and rapid search. Meanwhile, DICOM has maintained its file-centric model, adopting these advances more slowly than other domains.⁶

In digital pathology, specimen labels reliably link images to patient records, rendering the bundling of extensive metadata into files increasingly redundant and restrictive. In this context, DICOM's architecture, while effective in earlier systems, now limits the flexibility and scalability essential for multi-format exchanges—a prerequisite for integrating AI tools, cloud services, and advanced analytical workflows. This limitation is evident when additional middleware solutions must be developed to bridge the gap between DICOM-based Picture Archiving and Communication System (PACS) and cloud environments.⁷ Just as roads accommodate everything from compact cars to large trucks, no single file format or viewer can fully address the diverse needs of every medical imaging domain. The Bio-Formats library, for example, supports approximately 160 different formats, giving users a choice that suits their specific requirements.^8,9

Insisting on a one-size-fits-all approach is as impractical as mandating a single vehicle type for all traffic. Such rigidity in medical imaging limits opportunities to innovate, raises costs of software development and upgrades, and reduces the utility of digital slides. While DICOM adoption in pathology has increased in recent years, this very growth has underscored the architectural and security limitations of the format. These concerns are becoming increasingly apparent as more vendors and institutions integrate DICOM into pathology workflows, encountering familiar PACS-related challenges—data duplication, versioning inconsistencies, annotation challenges, complexity of de-identification, and heightened vulnerabilities in handling protected health information (PHI).^1,5,10, 11, 12, 13 The cumulative issues outlined above underscore the imperative to revisit the architectural choice.

Monolithic vs. Modular design

Central to the critique presented in this article are the concepts of monolithic and modular design, as articulated by Baldwin and Clark in their influential work Design Rules: The Power of Modularity. Baldwin and Clark define modularization as:

“The procedure that uses knowledge of design structure and design parameter interdependencies to create design rules. These design rules support an efficient and flexible task structure, allowing parts of the design to be worked on independently and in parallel with one another. Independent parallel efforts are possible because design rules explicitly address all the implicit interdependencies. Thus, when the parts are brought together, they function seamlessly as a system.”¹⁴

In simpler terms, a modular system clearly separates components or tasks, each governed by clear rules and managed independently. This approach allows individual components to evolve, be secured, maintained, and upgraded independently, enhancing flexibility and resilience. In contrast, a monolithic system tightly integrates multiple functions, data types, and tasks within a single entity or framework. Whereas potentially simpler at initial design stages, monolithic architectures become increasingly difficult to test, manage, and secure as complexity and risk increase.

This article applies principles of modularity to digital pathology imaging, demonstrating that DICOM's file-centric architecture is inherently monolithic and introduces significant risks to cybersecurity, interoperability, and system scalability. In contrast, a modular approach separates these functions into specialized, interoperable layers. Pixel data is stored in formats such as TIFF (Tagged Image File Format), OME-TIFF (an extension developed by the Open Microscopy Environment to support scientific imaging metadata), or Zarr (a chunked, cloud-optimized format for large multidimensional arrays); metadata is managed through HL7 FHIR (Health Level Seven Fast Healthcare Interoperability Resources, a modern web-based standard for clinical data exchange); and annotations are handled using open, flexible formats such as SVG (Scalable Vector Graphics) or GeoJSON (a JSON-based standard for spatial data).

This separation enhances security, promotes adaptability, supports digital pathology's evolving needs—and ensures compatibility with tools and standards that extend beyond healthcare. Throughout this analysis, the article draws on Baldwin and Clark's framework to demonstrate how modularity can transform digital pathology into a more secure, interoperable, and future-ready system, reducing architectural rigidity and security risks.

Architectural cybersecurity risks inherent in the DICOM standard

Healthcare data security breaches have increased with substantial implications for patient privacy. According to the Office for Civil Rights (see Fig. 1), between May 2022 and May 2025, healthcare providers reported 1475 breaches. Of these, 929 incidents (63%) were network server intrusions, compromising the data of over 123 million individuals. In contrast, direct breaches of electronic health records (EHRs) remain lower accounted for less than 5% of incidents, affecting approximately 4.8 million patients and highlighting how network servers where imaging data are typically stored often lack the same level of protection.¹⁵

Fig. 1.

OCR - reported healthcare provider data breaches by location and impact in the past 3 years.¹⁶

A 2023 cybersecurity breach at Lehigh Valley Health Network, resulting in a $65 million settlement, demonstrated significant vulnerabilities in systems storing radiology images with PHI on network servers.¹⁷ Concurrent litigation at Mayo Clinic involving unauthorized internal access to patient data¹⁸ underscored that security risks in healthcare arise from both external and internal vectors. These cases illustrate a fundamental vulnerability: file-based storage of medical images on network servers presents substantially higher security risks compared to more robust architectural approaches.

The security implications of PACS have drawn considerable attention. In 2019, multiple breaches exposed diagnostic imaging data and associated personally identifiable information (PII) and PHI, prompting congressional scrutiny.^19,20 The vulnerabilities of PACS are multifaceted, stemming from obsolete software and poor encryption. A notable example is Touchstone Medical Imaging's $3 million HIPAA violation settlement after the exposure of 300,000 patients' PHI.²¹

Despite these incidents, comprehensive analyses of architectural vulnerabilities specific to DICOM-based systems have been relatively scarce in the literature. A comprehensive review, Cybersecurity in PACS and Medical Imaging, identified a “remarkable disconnect” between general healthcare cybersecurity literature and PACS-specific security challenges.¹ However, the review focused primarily on incremental improvements to PACS, while overlooking deeper architectural vulnerabilities that continue to expose these applications to systemic risk.

The urgency of addressing these vulnerabilities was underscored at Black Hat Europe 2023, where security researchers Yazdanmehr and Akkulak exposed critical flaws that according to them were rooted in the DICOM protocol itself. Their investigation uncovered the exposure of PII affecting 16 million individuals and PHI of 43 million patients. Their research led them to conclude that “Continued use of legacy protocols, like DICOM, poses ongoing and significant security risks”.22, 23, 24 This demonstration directly attributed PACS vulnerabilities to DICOM's architectural design—highlighting how loosely defined specifications, embedded communication mechanisms, and weak security governance create systemic risks that leave patient images vulnerable to compromise.

Vulnerabilities in DICOM based systems frequently extend beyond deliberate intrusions, encompassing inadvertent PHI exposure due to insufficient de-identification protocols. The structural embedding of patient identifiers in DICOM files—including names, birth dates, and medical record numbers—introduces persistent privacy risks when these files are shared or stored in inadequately secured environments. This issue gained prominence in August 2020, when three major professional organizations—the American College of Radiology, the Society for Imaging Informatics in Medicine, and the Radiological Society of North America—issued a formal advisory regarding unintended PHI exposure in academic presentations. The advisory highlighted how modern web-crawling technologies can index and expose patient identifiers from presentations containing DICOM-derived images, even when traditional anonymization methods have been applied.²⁵ This underscores a deeper flaw in DICOM's design: embedding PHI directly into image files appears to create enduring privacy risks, especially in academic, research, and non-clinical contexts where images are often reused without robust protections.

Additionally, DICOM's data-rich file structure magnifies data synchronization challenges when files are transferred or shared between different systems or organizations. Because DICOM lacks built-in versioning, any changes made to patient data or metadata in the original system are not automatically reflected in detached copies of the files. This creates a high risk of misidentification and error propagation, as updates in the source of truth do not cascade to previously distributed versions. Maintaining accurate, synchronized records across healthcare systems thus becomes increasingly difficult, significantly impairing clinical workflows and research collaborations.

Even with the most rigorous implementation of layered security, as recommended by National Institute of Standards and Technology (NIST) (e.g., encryption at rest and in transit, identity and access management, and secrets management)²⁶—whether these features are explicitly addressed within DICOM or supplemented at the organizational level—fundamental limitations frequently persist in many implementations. These measures, while essential, cannot fully resolve a core architectural issue: the coupling of mutable patient identifiers with immutable image data within a single file structure. This design introduces a persistent integrity paradox: when image and metadata are encrypted together, independent verification of image authenticity becomes impossible without full decryption. Moreover, routine updates to patient information necessitate altering the file, thereby invalidating any prior cryptographic signatures. Consequently, despite most rigorous adherence to recommended security practices, DICOM's architecture appears inherently unable to provide robust mechanisms for ensuring image authenticity and maintaining data integrity in modern, dynamic healthcare environments.²²

Modern data integrity standards, particularly those aligned with NIST frameworks, advocate for a more robust architectural approach. This includes cryptographically signing image files according to current NIST specifications, maintaining these signatures alongside patient information in segregated, secure databases, and implementing dedicated security layers based on established frameworks.^26,27

An analysis of publicly available DICOM conformance statements reveals a general absence of support for standardized security profiles in many implementations.¹⁶ Even modern PACS systems frequently lack integration with established enterprise security frameworks—such as automated credential rotation, role-based access control, or cryptographic key management supported in modern cloud architectures. As a result, securing DICOM environments typically depends on institution-specific measures, including encrypted network tunnels and layered access controls. While these approaches may offer some protection, they are complex to maintain, costly to scale, and insufficient to mitigate well-documented risks—such as unencrypted metadata exposure, inconsistent access control enforcement, and attack surfaces revealed through passive DICOM parsing.²⁸

Protecting patient privacy and ensuring data security require a fundamental architectural shift. The solution lies in separating sensitive information into dedicated database management systems while keeping image files free of high-risk metadata. This approach simplifies compliance while improving data utility and enabling robust, future-facing clinical and research workflows. Decoupling annotations and metadata provides the modularity (as shown in Box 1), scalability, and adaptability necessary for digital pathology's future.

Box 1.

NIST definition of modularity

Source: NIST SP 800-160 Vol 1 – Systems Security Engineering

As cybersecurity threats escalate and regulatory requirements evolve, such an architectural evolution is not merely an enhancement but an essential transition.^26,29,30 This shift represents a critical opportunity for next-generation image management technology to align with contemporary data integrity and security standards, ensuring resilience and scalability in the face of increasingly sophisticated threats.³¹

DICOM's optional security provisions address only a narrow slice of the multilayer defences prescribed by frameworks such as NIST SP 800-53 and NIST SP 800-160.^29,32 Effective protection is determined at the system level, not within individual image files.^1,33 Accordingly, DICOM would be better served by retiring its embedded security section and deferring to specialized standards that govern all digital assets uniformly. Without enforced compliance or comprehensive scope, DICOM's security “section” can create a false sense of safety, delaying adoption of modern granular security practices.

A promising solution is the "security overlay" model. NIST SP 800-53 defines an overlay as a community-specific tailoring of its baseline security controls, supplying implementation guidance that can be reused across heterogeneous systems. Adopting a digital-pathology security overlay would let any imaging format—DICOM, OME-TIFF, OME-Zarr, or any future cloud-ready standards—inherit a HIPAA-aligned, format-agnostic control set, decoupling security governance from file architecture and reinforcing the modular strategy this article proposes (see Fig. 2). For example, the overlay could map HIPAA §164.312(e) to SP 800-53 control SC-13 (Cryptographic Protection), requiring SHA-256 image hashes and FIPS-validated Transport Layer Security 1.3 for tile transfers—regardless of how pixel data are stored.

Fig. 2.

Side-by-side comparison of the monolithic DICOM stack (left) and a modular, cloud-native architecture (right). In the monolithic model, pixel data, metadata, annotations, communication protocols, and security controls are bound together inside a single DICOM envelope, creating tight coupling and limiting scalability. The modular stack separates these concerns into discrete services: pixel data stored in cloud-optimized file formats (e.g., OME-TIFF, Zarr), metadata exposed through HL7 FHIR APIs, and annotations exchanged as GeoJSON/SVG. A NIST SP 800-53 security overlay spans all layers, while an API/micro-service tier enables AI inference engines and cloud storage to interact with each component independently, reducing vendor lock-in and lowering migration costs.¹⁶

*The architecture is format-agnostic: additional pixel formats (e.g., BigTIFF, DZI), databases (SQL or NoSQL), or annotation standards can be substituted as they mature, allowing each layer to evolve independently and supporting rapid adoption of future standards.

While DICOM's monolithic design once met the needs of early digital imaging, it now sits at odds with a growing number of use cases, increasingly intricate permission models, modern cybersecurity requirements, and cloud-native engineering practices. Evolving toward lightweight, purpose-built modular frameworks will unlock the secure, scalable, and efficient growth that digital pathology now requires.

Continued reliance on DICOM's originally effective—but increasingly constrained—architecture is likely to slow digital-pathology progress because it omits many advances in modern cybersecurity and systems design. Adopting lightweight, purpose-built modular frameworks can better support the secure, scalable, and efficient platforms that contemporary pathology workflows now require.

Elusive interoperability

Interoperability has become a ubiquitous term in healthcare and technology—so much so that it is often invoked in the very first sentence of discussions related to DICOM.^11,34,35 The term is often presented as an inherent attribute of the standard, where DICOM adoption is frequently associated with guaranteed compatibility. Yet, the implied meaning of “interoperability” is often left unexamined.

Despite its ubiquity, interoperability is a relatively modern and evolving concept. Its roots trace back to World War II, when the U.S. military struggled with incompatible equipment and communication protocols across service branches and with allies. By the mid-1960s, it had entered the military lexicon, and by the 1970s, the U.S. Department of Defense formally defined it as the use of common services and devices to achieve shared objectives.³² This definition underscored a crucial principle: interoperability is binary—it either exists or it does not. Partial or fragmented functionality fails to meet that bar.

As modern computing and information technology took shape in the 1970s and beyond, interoperability adopted new, more technical meanings and spread far beyond the military realm. It became relevant to government, private industry, and healthcare. Over the next 3 decades, researchers refined, measured, and worked to improve interoperability. By 2007, the “Survey on Interoperability Measurement” and other publications documented more than three dozen definitions and eight different measurement models, each focusing on various aspects—technical, semantic, organizational, and programmatic.^36,37 Despite this proliferation of frameworks, complete and categorical interoperability remained elusive.

Healthcare offers a vivid example of these enduring challenges. The field, much like the Department of Defense earlier, faces complex interoperability hurdles. In response, the Healthcare Information and Management Systems Society introduced a layered framework outlining four levels of interoperability: foundational, structural, semantic, and organizational.³⁸ While useful in identifying specific barriers, this approach implies that interoperability can be achieved gradually—a notion that runs counter to the original binary concept. The European Interoperability Framework likewise segments interoperability into governance, organizational, semantic, legal, and technical dimensions.³⁹ Yet truly seamless cross-border or cross-organizational data exchange still depends on sustained policy alignment, political will, mutual trust, and technical harmonization.

In this context, the DICOM standard often functions more as a partial advance toward interoperability rather than a comprehensive solution. While DICOM-based systems may agree on certain data structures or image formats, they frequently struggle with specialized requirements, metadata integration issues, and computational inefficiencies.² As in the above military and European Union examples, systems implementing the same “standard” may still struggle to work together seamlessly, revealing underlying compatibility challenges that complicate true interoperability.

For instance, Lang et al.⁴⁰ report issues with DICOM's application to neurophysiology—most notably, a lack of standardized annotation frameworks and limited support for specialized workflows. These shortcomings resemble those in digital pathology, where the goal extends beyond handling images to orchestrating complex diagnostic processes. Clunie emphasizes DICOM's potential by citing the IEEE definition of interoperability: “the ability of two or more systems or components to exchange information and to use the information that has been exchanged”.³⁵ However, his own analysis focuses largely on basic data exchange. It stops short of demonstrating true interoperability—especially in areas like metadata management, annotations, and computational efficiency.

Ironically, Clunie's evidence also illustrates why TIFF might be better suited to digital pathology than DICOM. TIFF's widespread adoption across whole slide imaging (WSI) platforms—including vendor-extended formats like SVS (classic TIFF) and BIF (BigTIFF), as well as open variants like OME-TIFF—meets WSI requirements effectively and economically. As a cross-industry standard, TIFF benefits from a compact specification (around a hundred pages versus DICOM's thousands), enabling robust implementations across sectors ranging from publishing to remote sensing. Its well-established ecosystem, open validation tools, and seamless integration into existing imaging software reduce development costs for manufacturers. Notably, most, if not all, published AI foundation models in pathology to date have relied on TIFF, SVS, or JPEG rather than DICOM, reflecting TIFF's adaptability to pathology's specialized workflows.

Unlike DICOM, which integrates metadata and communication protocols into a single framework, TIFF is limited in scope, focusing solely on image data. This narrower design aligns with modern principles of modular architecture, in which communication and metadata layers evolve independently through specialized standards. Even successful DICOM implementations rarely achieve seamless integration without extensive customization. Genereaux⁴¹ illustrates how ultrasound systems, despite adhering to DICOM standards, may still fail to interoperate on the same network.

Similarly, Herrmann et al.¹¹ show that basic technical feasibility metrics—such as metadata encoding and pixel data handling—do not necessarily translate into end-to-end interoperability. Their implementation omits crucial pathology-specific parameters like stain characteristics, diagnostic annotations, and specimen preparation protocols, highlighting DICOM's radiology-centric architecture and its difficulty in accommodating pathology's unique requirements. This misalignment appears in other domains—neurophysiology, ophthalmology, and more—that must continually adapt DICOM through numerous supplements to fit their specialized needs.

Ultimately, these experiences show why interoperability must be treated as a categorical imperative, not an incremental milestone. Portraying it as an inherent property of DICOM—without evidence—risks obscuring substantial technical and operational hurdles. The field of digital pathology, in particular, requires rigorous review of specifications, comparative benchmarking, and a balanced appraisal of DICOM's architecture and capabilities alongside its proven limitations. A deeper, more nuanced understanding of these issues is essential for developing evidence-based implementation strategies that move beyond image management to support comprehensive digital and diagnostic workflows in pathology.

Lessons from other standardization initiatives reinforce the value of specialization. The World Wide Web Consortium (W3C) has consistently emphasized separating content (HTML), presentation (CSS), and behavioral logic (JavaScript/TypeScript), allowing each layer to advance independently while maintaining functional interoperability.⁴² Applying these principles to digital pathology could enable faster innovation, greater scalability, and robust data exchange.

While radiology continues to contend with the limitations of evolving DICOM-based infrastructure and costly upgrades, pathology must take care not to replicate these constraints.² Retrofitting DICOM to support cloud native and AI-driven workflows is emerging as deeply complex challenge within radiology—one that falls outside the scope of this article. For pathology, the risk is clear: adopting a DICOM-centric framework as it currently stands would inherit decades of architectural legacy and introduce unforeseen barriers to research, lab operations, AI integration, and cloud-native workflow design.

The question of how DICOM might continue to evolve—whether incrementally, by decoupling communication layers in favor of HL7 FHIR, or through more radical restructuring—is a matter for the radiology domain and its stakeholders. Meaningful change would likely require broad industry collaboration and consortium-led initiatives. Regardless of how that process unfolds, pathology need not wait for such developments. Instead, it should pursue its own path, fostering polyglot, modular systems built on widely supported open formats, ready to rapidly adapt as technologies evolve.

By positioning DICOM's image management as central to interoperability, current efforts risk overlooking the broader needs of pathology. The discipline requires orchestration systems that integrate imaging, patient history, molecular data, and AI-driven insights within complex workflows. HL7-based frameworks already offer a proven pathway for data exchange in pathology, making a pivot to DICOM-centric communication unnecessarily complicated. Moving forward, a fully modular strategy—rooted in well-defined application programming interfaces (APIs), command-line tools, RESTful services, and HL7 FHIR protocols—can promote true interoperability without sacrificing security, scalability, or innovation.

Annotation challenges

Annotations and metadata in pathology are inherently more complex than those encountered in radiology, encompassing dynamic datasets that span pre-analytic, analytic, and post-analytic workflows. These include drawings, measurement overlays, textual notes, and AI-generated insights—each requiring detailed metadata descriptors such as authorship, creation time, diagnostic significance, intended purpose, privacy classifications, and access permissions. Managing this evolving information demands sophisticated data architectures, such as NoSQL or hybrid database models, to support frequent updates, complex queries, and hierarchical relationships.

Embedding such metadata within DICOM's file structures typically introduces scalability bottlenecks and disproportionately increases storage costs, particularly in cloud environments where data access incurs costs for every request, regardless of file size.43, 44, 45 This raises important questions about the necessity of embedding metadata within image files. Decoupling metadata from pixel data transforms images into immutable, self-contained units that can be stored, retrieved, and analyzed independently.

The limitations of embedding annotations within image files extend beyond the compliance challenges outlined earlier. Conflating static image data with dynamic descriptors—such as tumor demarcations, molecular targets, and diagnostic notes—creates inflexible systems vulnerable to data integrity issues. These annotations often require versioning, granular access controls, and frequent updates—capabilities far better handled by databases and external indexes. The problem is especially acute in pathology, where WSI annotations span multiple resolutions and must comply with stringent traceability standards. Pathology systems would benefit from adopting modern, cross-industry, database-driven annotation frameworks that support modularity, reduce maintenance overhead, lower costs, and accelerate innovation.^46,47

Projects like Slim, a WSI viewer and DICOM-based annotation tool, illustrate the limitations of DICOM-centric design and, in doing so, underscore the advantages of modular approaches.⁴⁸ Built on a modern web development stack and thoughtfully engineered, Slim exemplifies high-quality software aligned with current frontend best practices. Its functionality is powered by OpenLayers—a high-performance, open-source JavaScript library for rendering spatial data in web applications.³⁴ OpenLayers supports a wide range of image formats and annotation types, including GeoJSON and SVG. Therefore, annotations can be managed independently of image data. Slim, however, constrains OpenLayers' inherent flexibility by prioritizing DICOM compatibility, which limits its broader adaptability. This contrast illustrates a wider principle: independent annotation layers—such as SVG—enable scalable and interoperable cross-industry ecosystems, while DICOM based annotations appear isolated.^34,48

Real-world, JSON/SVG-based annotation frameworks already power high-traffic imaging libraries. A working demonstration of that approach in medical imaging workflow further proves the point.⁴⁹ The broader lesson is clear: annotations and metadata do not inherently belong within image files. This coupling restricts independent innovation in annotation technologies by binding them to the constraints of the imaging standard. As Baldwin and Clark have shown, modular architectures foster innovation by allowing components to develop independently, without being limited by the constraints of adjacent systems.¹⁴ By adopting SVG or GeoJSON annotation standards, as Tang et al. implementation demonstrates, the pathology community can create scalable, secure, and innovative systems tailored to its unique requirements.⁴⁹ This transition is not merely a convenience but a necessity for building sustainable future-ready digital pathology workflows.

The principles of modular design

Across nearly every domain of modern technology, a clear trend has emerged: breaking down complex systems into smaller, interchangeable components that operate together as adaptive ecosystems. This shift began with the introduction of the IBM System/360 in the mid-1960s—a groundbreaking, modular computing architecture that allowed compatibility across a family of machines—and has since evolved into the microservices-based infrastructures of companies like Netflix.^50,51 By enabling systems to evolve rapidly, scale efficiently, and foster innovation within independently developed components, modularity has become a defining principle of contemporary system design.

The transformation gained theoretical momentum in the early 2000s with the publication of the Agile Manifesto, which marked a paradigm shift in software development by emphasizing iterative progress, cross-functional collaboration, and continuous adaptability.⁵²

Over time, Agile methodologies evolved into specialized operational frameworks—such as DevSecOps for secure software development, FinOps for cloud cost optimization, and MLOps for managing machine learning life cycles—each tailored to address the distinct challenges of modern engineering environments.⁵³ These frameworks underscore the enduring power of modularity, and the growing importance of domain-specific, flexible architectures in an ever-changing technological landscape.

The landmark work of Baldwin and Clark on modular design¹⁴ provided both empirical evidence and a rigorous mathematical framework for understanding modularity's role in technological progress. Their research established modularity as a cornerstone of innovation, demonstrating that breaking down complex systems into self-contained modules enables incremental development, efficient testing, and cost-effective evolution. Over two decades of subsequent research and countless real-world applications have reinforced these findings, underscoring modularity's transformative impact across multiple industries.

Prominent examples, such as Netflix, Google Cloud, and AWS, etc., showcase how a systematic focus on modular design can streamline development, reduce costs, and deliver highly scalable systems.⁵⁴ These organizations leverage modularity to integrate cutting-edge technologies—like security-by-design and AI-driven automation—without disrupting their broader ecosystems. By allowing individual components to be replaced or upgraded independently, modular architectures accommodate the rapid pace of technological change while minimizing risk.

Our own experience in pathology informatics is deeply rooted in the power of modularity, as described in Customizing Laboratory Information Systems: Closing the Functionality Gap, we extended a core Laboratory Information System (LIS) with continuum-based modular solutions covering the entire workflow—from specimen accessioning to final sign-out.⁵⁵ A centralized Pathology Portal integrates data from the EHR (radiology, endoscopy, and surgical notes) and historical pathology records, while a specialized repetitive-task scheduling engine orchestrates various processes. This design facilitated seamless incorporation of WSI through a vendor-provided viewer and enabled efficient image de-identification using the open-source DSA-WSI-DeID tool.⁵⁶

By decoupling data aggregation, indexing, natural language search functionality, imaging, and de-identification from the underlying LIS, each module could be developed, audited, and secured in isolation, yet still leverage centralized authentication and single sign-on. This approach expedited code auditing, dependency analysis, and security reviews, as each component was well-defined and easier to evaluate. Moreover, the modular architecture streamlined the creation of WSI sets for tumor boards, research validation, and specialized workflows—such as digitized positive controls—where precise linkage to immunostain batches is vital, but no PHI is involved. Freed from monolithic constraints, we rapidly transitioned to newer cloud-based frameworks, ultimately rethinking our entire approach to engineering pathology under a concept we call “REALM” (Rapidly Evolving Agile Laboratory Modules). This paradigm better reflects the orchestrated nature of pathology systems and the true functional interoperability of their components—without defaulting to an all-encompassing standard.

The advantages of modularity, in our experience, extend beyond software development. Modularity enables functional interoperability, allowing systems to share capabilities without requiring extensive data migration. The ability to exchange functionality—not just data—is the hallmark of true interoperability. This is best achieved through modern frameworks such as well-documented APIs, which allow systems to invoke each other's functions, and Command-Line Interfaces, which support automation and flexible integration in modular environments.⁵⁷

In bioimaging, the value of modularity is just as clear. The OME Consortium's open-source tools—such as OMERO and Bio-Formats demonstrate how decoupled architectures, clear interfaces, and active community development can streamline image workflows. By adhering to modular design principles, these platforms integrate flexibly into diverse imaging pipelines, accelerating innovation and scalability offering a robust alternative to DICOM.⁵⁸

Proponents of DICOM often describe it as an “evolving standard”, emphasizing its adaptability. However, this claim is inherently contradictory—semantically an oxymoron. A truly robust standard requires strong governance, precise versioning, backward compatibility, and a well-defined functional scope that is essential for consistent development.^59,60

DICOM has played a central role in enabling file compatibility and exchange within radiology and remains foundational in many imaging systems. However, as this article demonstrates through evidence drawn from multiple industries and standards bodies, the introduction of modularity is not merely an enhancement—it is essential for meeting the growing complexity of digital healthcare. Modularity, as seen across modern technological domains, enables systems to evolve, integrate, and innovate more rapidly and efficiently. Incorporating modular principles into DICOM's evolution could greatly enhance its flexibility, better align it with emerging standards like HL7 FHIR, and support the orchestration of AI-driven, data-rich workflows—particularly in digital pathology.

Importantly, a modular approach allows multiple imaging formats to coexist within a unified, standards-based framework. DICOM, re-imagined not as an all-encompassing container but as an interoperability facilitator, can guide the development of polyglot systems, where diverse formats like TIFF, OME-TIFF, or Zarr operate seamlessly under well-defined protocols. Such a shift could have a transformative effect, not only improving DICOM's adaptability but also accelerating the broader modernization of digital systems in medicine, which is urgently needed. Many healthcare IT infrastructures remain outdated, and the cost of upgrading these monolithic systems poses a significant barrier for institutions worldwide.

Lightweight gateway microservices can ease this transition by reducing the need for costly bulk conversion of legacy WSIs. Instead of reformatting archives, a microservice can stream tiles from existing SVS, BigTIFF, or DICOM files on the fly, expose their metadata through the same FHIR/JSON API used by new images, and assign stable unique identifiers. This shim—analogous to the Wi-Fi⁶¹ drivers that let old Ethernet devices speak modern protocols—lets institutions phase out PACS at their own pace while still embracing the modular architecture.

By embracing modularity, DICOM could help lower these barriers, fostering a more agile, sustainable, and innovative ecosystem for medical imaging, as demonstrated by open-source projects such as HistomicsUI.^62,63 In this role, modular DICOM could leverage its advocacy and institutional experience to help unify healthcare data exchange, ensuring that imaging integrates seamlessly into broader data ecosystems. A re-imagined DICOM could bridge gaps between disparate systems and support secure, scalable, and interoperable healthcare communication.

Conclusion

The evidence presented throughout this article demonstrates that DICOM's architecture, while historically effective and valuable for radiology, presents significant limitations when applied to digital pathology. Our analysis has identified several key concerns: inherent cybersecurity vulnerabilities stemming from embedded patient information; interoperability challenges that frequently require extensive customization; annotation constraints that inhibit complex pathology workflows; and an architectural rigidity that in many implementations struggles to accommodate modern cloud-native principles.

A modular, ecosystem-driven framework offers a forward-looking alternative that overcomes DICOM's constraints. By decoupling immutable image data from mutable metadata and leveraging well-defined, purpose-specific standards such as HL7 FHIR, TIFF variants, SVG, digital pathology systems can achieve greater flexibility and enhanced security.⁴⁹ This approach supports granular access control, efficient data de-identification, access auditing, and compatibility with emerging imaging formats. It aligns with modern data management principles and major regulations such as the General Data Protection Regulation in the EU and HIPAA in the U.S., both of which impose strict requirements for data privacy and security.

This paradigm shift is more than a technical enhancement; it represents a necessary evolution in digital pathology, fostering innovation and aligning with broader trends in biomedical data management. Collaborative efforts among industry stakeholders, standards organizations, and regulatory bodies are essential to develop API-driven architectures that prioritize modularity and interchangeability without imposing rigid, one-size-fits-all frameworks.

DICOM, with its experience in standardization, advocacy, and organizational influence, is uniquely positioned to play a harmonizing role in this transition. Modular standards could help DICOM to address the shortcomings of its model, while accelerating the adoption of lightweight, interoperable solutions. Industries such as geospatial imaging, W3C web standards, and consumer technology have shown that modularity and interchangeability not only drive efficiency, resilience, and user-centered design—but also create long-term value by enabling continuous innovation.

As the seasons of technology shift, it may be time to rethink the wardrobe. The weight and cost of historically effective but now limiting frameworks must give way to lightweight, modular, and adaptable solutions, heralding a future where digital pathology thrives with the freedom and flexibility demanded by modern healthcare.

Declaration of competing interest

The authors declare the following financial interests/personal relationships which may be considered as potential competing interests:

Peter Gershkovich reports a relationship with Applikate Inc. that includes: consulting or advisory. If there are other authors, they declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this article.