Backing Up Dental Imaging: CBCT, Intraoral Scans

Why does dental imaging get left out of backups?

Because imaging usually does not live where you think it does. Your practice-management system stores the chart, the ledger, the appointment book and pointers to images, but the actual image files are almost always written to a separate folder, drive, or imaging server. A backup job pointed only at the PMS database will faithfully protect every record and silently skip every radiograph.

That gap is easy to miss for years, because everything looks fine until the day you try to restore. The chart comes back, you open a patient, and the image thumbnails are gray boxes. This is one of the most common and most painful imaging-recovery failures we see, and it is entirely preventable.

It also matters more than ever. Ransomware against healthcare rose roughly 58% in 2025, with dental and other secondary targets making up about 26% of incidents . Imaging is a favorite casualty: it is large, it is referenced everywhere, and it is often stored on the least-protected drive in the building.

What counts as "dental imaging"?

Imaging is not one file type. It is a family of formats with very different sizes and storage habits, and each one has its own backup considerations. Here is how the major types compare.

Imaging type	What it is	Relative file size	Backup consideration
CBCT volumes	3D cone-beam scans used for implants, endo, and surgery	Very large	Stored by the CBCT/acquisition software, often on a dedicated workstation or server outside the PMS; the single biggest space and recovery item
Intraoral scanner files (STL / 3D)	Digital impression meshes from intraoral scanners	Large	Frequently kept in the scanner's own library or a cloud portal, not the PMS; export/sync path must be captured
Panoramic / cephalometric	Pan and ceph radiographs	Medium to large	Live in the imaging bridge software's image store, usually a folder tree separate from the database
Intraoral sensor X-rays	Bitewings, periapicals from sensors	Small to medium each, large in aggregate	Many small files per patient; the volume adds up fast and the folder structure must stay intact
Clinical photos	Intraoral and portrait photography	Medium	Often dumped into ad-hoc folders or a camera-import directory; easy to forget entirely

The pattern across every row is the same: imaging is large, it usually sits outside the PMS database in separate folders or drives, and it is the thing most often missed. (Typical per-study sizes vary widely by sensor and resolution {{VERIFY: typical size}}, which is why we describe them qualitatively rather than quoting fixed numbers.)

The records-and-images consistency problem

A patient record without its images is half a chart. An image library without its records is an orphaned pile of files. You need both, captured together.

The PMS database holds the pointers; the image folders hold the pixels. If you back them up at different times, or back up one but not the other, a restore can leave you with records that reference images that no longer exist, or images no application can find. The fix is to capture the database and the image stores as one consistent set, ideally at the same moment, so the references and the files always agree.

How do I find everywhere my images are stored?

Start by inventorying every imaging source in the practice, then trace where each one writes files.

1. List your imaging hardware and software. CBCT, pan/ceph, sensors, intraoral scanners, and cameras each have acquisition or bridge software. Each one has a configured storage path.
2. Open each program's storage or path settings. Note the exact folder, drive letter, or server share where images land. These are the locations your backup must include.
3. Check the imaging server separately. Many practices run a dedicated imaging workstation or server. Its image volume is often the largest single thing in the building and the most likely to be excluded from a PMS-only backup.
4. Look for cloud or scanner portals. Some intraoral scanners keep masters in a vendor cloud. Confirm you have an export or sync path so those files are also protected.
5. Map paths back to patients. Confirm the folder structure your software uses to associate images with records, so it is preserved exactly on restore.

If you are protecting a specific platform, our Dentrix backup guide and Open Dental backup guide walk through where each system stores its database and how the imaging folders relate to it.

What does a correct imaging backup look like?

A correct imaging backup captures the PMS database and every image store together, application-consistently, and sends them somewhere ransomware cannot touch.

In practice that means a few principles:

• Application-consistent capture of the database plus the imaging folders, so open files and in-flight writes are captured cleanly rather than half-written.
• Everything in one protected set, so records and images stay synchronized and a single restore brings back a complete patient.
• Encrypted, off-site copies so a fire, theft, or building-wide ransomware event cannot take the only copy with it. The Tampa Bay Dental Implants incident, where roughly 6,400 patients were affected and the encrypted server also held the backups , is the textbook case for keeping copies off the box.
• Immutable, write-once storage so that even if an attacker reaches your environment, existing imaging backups cannot be altered or deleted.
• Tested restores. Periodically restore a sample patient and actually open their CBCT, a few X-rays, and a scan. A backup you have never restored is a hypothesis, not a safety net.

This is the model DDSArk is built around: MSP-managed, application-consistent capture of the database and imaging together, encrypted and sent off-site to immutable write-once storage, under a HIPAA business associate agreement. Specifics of retention and scheduling are configured per practice.

How often should imaging be backed up?

At least as often as your records, and on the same schedule, so the two never drift apart. New CBCT scans and scanner files appear every clinical day, and the most recent imaging is often the most important for active treatment. A nightly application-consistent capture of database-plus-imaging is a sensible baseline; busier or surgical practices may want more frequent protection. Whatever the cadence, the rule that matters is that records and images are always captured together.