In your imaging suite, use Export — not Save Image or a screen capture. Choose DICOM for CBCT and 2D radiographs, and the native STL/PLY export for intraoral scans. Export the full study, not single slices, and include the viewer if your software offers to bundle one.
Zip the study into one folder named with the patient's last name, first initial, and date of service. Add a one-line note: what you're asking, which tooth, and your callback number. A referral without a question attached is just homework for the specialist.
Upload the zip to a secure transfer tool and text or email the link to the receiving office — send.intake.dental is free, needs no recipient account, and encrypts end to end so the key never touches a server. Note the transfer in the chart, and you're done in under five minutes.
A JPEG screenshot of a pano is not a diagnostic image. It's a lossy copy of whatever your monitor showed, with the contrast baked in and the measurement calibration gone. The receiving doctor can't window it, can't measure on it, and can't defend a treatment decision from it. Send originals: DICOM for CBCT and most 2D digital radiographs, the raw export from your sensor software for intraorals, and STL, PLY, or OBJ for scanner output from iTero, TRIOS, Medit, or Primescan. Nearly every imaging suite — Carestream, Planmeca, Sirona, and the rest — has an export function that produces real DICOM, often with a bundled viewer. Use it. A JPEG is fine as a quick reference alongside the originals, or when a patient just wants a copy for themselves. It is never a substitute for the source data on a referral.
Email fails this job two ways. First, size: most mail servers cap attachments around 25 MB. A single CBCT volume runs 100–400 MB, a full-mouth series plus photos easily clears the cap, and the failure mode is a bounce your front desk finds hours later — or never. Second, PHI: a patient's radiographs tied to their name are protected health information, and standard email is not encrypted end to end. It sits in plain form on servers you don't control, gets auto-forwarded, and lives forever in a sent folder. HIPAA doesn't ban emailing PHI outright, but it demands safeguards that ordinary Gmail-to-Gmail simply doesn't provide, and the burden is on you when it leaks. One misdirected attachment is a reportable breach. Your team shouldn't have to make that risk call at 4:55 pm on a Friday with a specialist waiting.
CDs and USB drives technically work — if the other office still has an optical drive, the patient doesn't lose the disc in their car, and you're fine with a two-day turnaround on something that should take two minutes. Fax is HIPAA-tolerated but useless for imaging: a faxed radiograph is diagnostic garbage, and a faxed CBCT isn't a thing. Imaging-vendor portals are better, but they assume both offices use the same ecosystem, someone remembers yet another password, and the recipient is willing to create an account to retrieve one file. That account-creation step is where many transfers quietly die. Every one of these methods also shares a hidden cost: staff time. Industry estimates put a single manual records transfer at 15–30 minutes of front-desk work once you count burning, labeling, calling to confirm, and resending. Multiply that by your monthly referral count.
You shouldn't. Standard email isn't encrypted end to end, so patient radiographs sent as attachments are PHI traveling without HIPAA-required safeguards — and most mail servers reject anything over about 25 MB anyway, which rules out CBCT entirely. Use an encrypted transfer link or a secure messaging tool with a BAA instead.
It can be. HIPAA doesn't ban email, but it requires reasonable safeguards for electronic PHI, and ordinary unencrypted email doesn't meet that bar. A misdirected or intercepted attachment is a potential reportable breach. One narrow exception: a patient may request their own records by unencrypted email after being warned of the risk.
Send the original diagnostic files: DICOM for CBCT and digital radiographs, and STL, PLY, or OBJ for intraoral scans. A JPEG is acceptable as a convenience copy for the patient, but it loses calibration and detail, so it should never be the only thing a treating doctor receives.
Export the full DICOM study from your CBCT software (Carestream, Planmeca, Sirona, and others all support this), zip the folder, and share it through an encrypted transfer link. CBCT volumes run 100–400 MB, so email won't carry them. Send at send.intake.dental is free, handles files that size, and the recipient needs no account.
Yes. Under HIPAA, patients have a right to their records, including radiographs, and can direct you to send them to another provider. You cannot withhold records over an unpaid balance. You may charge a reasonable, cost-based copying fee where state law allows, but the transfer itself isn't optional.
Send is free end-to-end encrypted file transfer built for dental offices: CBCT zips, STL scans, photos, PDFs — no size anxiety, no recipient account, no CD burner. The encryption key travels in the link and never touches our servers. Upload, share the link, get back to the patient in your chair.
The method that actually works: upload the original files once, send the recipient a link, done. The good implementations encrypt end to end — the files are encrypted before they leave your computer and the decryption key travels inside the link itself, so not even the transfer service can open them. That's a materially stronger position than email or a portal login. Send, our free tool at send.intake.dental, works exactly this way: it handles DICOM and CBCT zips, STL/PLY/OBJ scan files, photos, and PDFs at sizes far beyond email's cap, and the receiving office needs no account — they click, they download, they're reading the scan while your patient is still in the parking lot. For ongoing referral relationships, Bridge (also free) adds a colleague network with case chat, so the x-rays, the question, and the answer live in one audit-logged thread instead of six phone calls.
HIPAA gives you up to 30 days to fulfill a records request, and many states require faster turnaround. In practice, a referral shouldn't take anywhere near that: with originals exported and a secure link, the receiving office can have everything the same day the patient asks.
Standard SMS is like email, only worse: unencrypted, tied to personal phones, and impossible to audit. If you want that speed, use a HIPAA-appropriate channel — Bridge, our free secure chat for dental offices, supports case threads with x-ray, DICOM, and STL attachments, encrypted at rest and audit-logged, with a BAA at signup.
Every referral starts the same way: "Can you send the x-rays?" Then someone burns a CD, faxes a photocopy of a radiograph, or emails a 90 MB CBCT that bounces. Here's what to send, what to skip, and the two-minute method that works at any file size — from a dentist who has been on both ends of the bad handoff.
