ONC Is Coming for the Medical CD: Why 2026 May Finally Kill Disc-Based Sharing
On January 30, 2026, the Office of the National Coordinator for Health Information Technology — now operating as ASTP/ONC under the Assistant Secretary for Technology Policy — published a document that might not make headlines but could reshape how every medical scan in America gets shared.
It is a Request for Information on diagnostic imaging interoperability standards and certification criteria. In plain language: the federal government is asking how to build the rules that will eventually require health IT systems to share medical images electronically, through standardized APIs, without CDs, without proprietary portals, and without the fragmented mess that defines imaging exchange today.
The comment period closed on March 16, 2026. What comes next could fundamentally change how hospitals, imaging centers, and patients move diagnostic images from one place to another.
The problem the government is finally addressing
We have written before about why sharing a medical scan is absurdly difficult in 2026. The short version: despite decades of digital advancement, the dominant method of sharing medical images between healthcare facilities is still physical media.
Eighty percent of US healthcare organizations still share medical images on CDs, according to industry surveys. Not as a backup. As the primary method. Patients drive across town with plastic discs. Facilities mail them. Specialists wait days for imaging that was completed hours ago.
The reason is not that digital sharing technology does not exist. It is that no federal standard requires it. Electronic health records have been pushed toward interoperability through years of Meaningful Use requirements, USCDI data standards, and information blocking rules. Medical imaging has been largely left out of that framework.
EHRs exchange structured data through FHIR APIs. Lab results flow electronically. Clinical notes sync across systems. But the CT scan that could change a patient’s treatment plan? That still gets burned to a disc and handed across a reception desk.
The imaging interoperability RFI signals that ONC intends to close that gap.
What the RFI actually asks
The RFI is not a rule. It is the step before the step before a rule. But the questions it asks reveal the direction ONC is heading, and the direction is unmistakable.
The RFI seeks input on:
-
Which technical standards should apply to diagnostic imaging exchange. Specifically, it asks about DICOMweb, FHIR-based approaches, and the emerging SMART Imaging Access specification — a draft standard that would let applications retrieve imaging data through the same FHIR-based APIs that already power EHR data exchange.
-
What certification criteria should be established. Currently, the ONC Health IT Certification Program does not include specific certification criteria for diagnostic imaging capabilities. The RFI explores whether it should — and what those criteria would look like.
-
How metadata should be standardized. When imaging studies are shared, the accompanying metadata — patient demographics, study descriptions, clinical context, and increasingly, AI-generated annotations — needs to be consistent and machine-readable. The RFI asks how to make that happen.
-
What barriers prevent imaging interoperability today. ONC is asking the industry to document what is broken: reliance on portable media, limited API support in PACS systems, inconsistent metadata tagging, proprietary viewer requirements, and the lack of patient-facing access to their own imaging data.
The questions are technical. The implication is strategic. ONC is building the evidence base for future rulemaking that would require certified health IT systems to support standardized imaging exchange — the same way they are already required to support standardized clinical data exchange.
HTI-5: the FHIR-first foundation
The imaging RFI did not arrive in isolation. It was published weeks after the HTI-5 proposed rule — the Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions to Unleash Prosperity rule — which represents one of the most significant shifts in federal health IT policy in years.
HTI-5 does several things, but its most relevant move for imaging is reorienting the ONC Health IT Certification Program around FHIR-based APIs as the primary interoperability standard. While HTI-5 itself does not directly address imaging interoperability in detail — it actually withdraws some earlier HTI-2 proposals related to data expansion and imaging exchange — it establishes the technical foundation on which imaging standards will be built.
The logic is straightforward: first, establish FHIR as the universal API layer for health data exchange. Then, extend that layer to include imaging. The RFI is the bridge between those two steps.
This matters because it defines the architecture of the future. Medical images will not be exchanged through some imaging-specific protocol that exists outside the health IT ecosystem. They will flow through the same FHIR-based infrastructure that carries everything else. The ImagingStudy and DiagnosticReport resources in FHIR already exist to reference and include imaging data alongside other patient information.
The question is no longer whether imaging will join the FHIR ecosystem. It is when, and what the certification requirements will look like.
Why CDs have survived this long
If digital imaging exchange is technically possible — and it has been for years — why are CDs still the default?
No mandate. The 21st Century Cures Act and its information blocking provisions pushed EHR vendors toward interoperability for clinical data. Imaging was not explicitly covered in the same way. Without a regulatory requirement, PACS vendors and imaging centers had no compliance pressure to change.
Vendor lock-in. PACS systems are expensive, long-lived capital equipment. Many hospitals run PACS installations that are five, ten, or fifteen years old. These systems were designed around DICOM — a protocol from the early 1990s that assumes trusted local networks and has no built-in API layer. Upgrading to support modern web-based exchange requires investment that hospitals have been slow to make.
Interoperability is not the vendor’s incentive. For PACS vendors that also sell image exchange networks, making it easy to share images outside their network is a competitive disadvantage. Proprietary image exchange platforms create switching costs. CDs, ironically, are vendor-neutral — they work with any system that has a disc drive and a DICOM viewer.
Small practices lack resources. A three-radiologist outpatient imaging center does not have the IT budget or expertise to implement DICOMweb APIs, configure FHIR endpoints, or negotiate interoperability agreements with every referring facility. Burning a CD takes thirty seconds and costs a dollar. Until a mandate exists, the economic calculus favors the disc.
Patients have no leverage. Under HIPAA, patients have the right to their medical records. But exercising that right for imaging typically means requesting a CD — because that is the only format the facility offers. Patients cannot demand FHIR-based API access to their imaging data if the facility’s systems do not support it.
The ONC RFI targets every one of these barriers. By establishing certification criteria for imaging interoperability, it would create the regulatory pressure that the market has not generated on its own.
What this means for hospitals and imaging centers
If you run a hospital, imaging center, or radiology department, the RFI is a signal to start preparing — not because a rule is imminent, but because the direction is clear and the timeline is accelerating.
1. Audit your imaging exchange capabilities. Can your PACS support DICOMweb? Does it expose any FHIR-compatible endpoints? If your primary method of outbound image sharing is burning CDs or mailing USB drives, you are operating on borrowed time.
2. Evaluate your PACS vendor’s roadmap. Ask your vendor directly: what is your plan for FHIR-based imaging exchange? What SMART Imaging Access support is planned? If the answer is vague or nonexistent, that tells you something about whether this vendor will serve you in the post-CD future.
3. Budget for interoperability. The cost of implementing modern imaging exchange is real but manageable — and it will be significantly less than the cost of emergency compliance when a final rule drops with a two-year implementation timeline. Organizations that start now will have a competitive advantage.
4. Consider cloud-based sharing as an interim step. While the regulatory framework evolves, cloud-based image sharing platforms offer a practical bridge. They eliminate CDs today, provide encrypted and auditable exchange, and can integrate with FHIR-based systems as those standards mature.
5. Engage with the rulemaking process. If you have opinions about how imaging interoperability should be standardized, the time to express them was during the comment period. But the conversation is ongoing. Industry associations like the ACR, RSNA, and CHIME will be shaping the standards that emerge from this RFI.
What this means for patients
As a patient, you might not follow federal health IT rulemaking. But the outcome of this process will directly affect your experience the next time you need to share a scan with a new doctor.
Today, that experience typically involves one of the frustrating scenarios we described in our earlier post on medical scan sharing: CDs that do not open, portals that require separate logins for every facility, phone calls to radiology departments that go nowhere, and delays that push back diagnoses and treatment decisions.
The regulatory trajectory points toward a future where your imaging data is as accessible and portable as your lab results. Where sharing a CT scan with a new specialist is as simple as granting access through a standardized API. Where your complete imaging history — every X-ray, every MRI, every ultrasound — is part of your longitudinal health record, accessible from any certified system.
That future is not here yet. The RFI is a step in a multi-year process that will involve proposed rules, comment periods, final rules, and implementation timelines. If history is any guide, the timeline from RFI to enforcement will span several years.
But you do not have to wait for the regulations to catch up.
The bridge that exists today
The regulatory framework ONC is building will eventually require what forward-thinking platforms already deliver: secure, instant, standards-based medical image sharing without physical media or proprietary portals.
Medixshare, from AI Bharata, was built on exactly this premise. When you share a scan through Medixshare:
- No CD, no USB, no portal login. Your scan is shared via a secure link — SMS, WhatsApp, or email. The recipient opens it in any browser, on any device.
- Native resolution. No compression, no quality loss. The specialist sees exactly what the radiologist sees — full diagnostic-quality images.
- Encrypted and expiring. Your data is encrypted in transit and at rest. Access links expire automatically. You control who sees your scans and for how long.
- Instant. No three-to-five business day transfer windows. No waiting for a CD to arrive in the mail. Share a scan in seconds, from anywhere.
- Patient-owned. You control your imaging data. Share it with any doctor, any facility, any time — without calling a radiology department or filling out a release form.
The regulatory direction is clear: the CD is living on borrowed time. DICOM security vulnerabilities add urgency. Patient frustration with portals adds demand. And now, federal rulemaking adds regulatory momentum.
You can wait for the rules. Or you can share your scans the way the regulations are heading — digitally, securely, and instantly.
Ready to leave the CD behind? Get started with Medixshare — share your medical scans instantly with any doctor, for free. No disc, no portal, no app download required.
Running an imaging center or hospital? Learn how Medixshare streamlines your image sharing workflows and positions your organization ahead of the coming interoperability requirements.