Orthanc for a Dental Clinic: Setup, Security, Backup

Orthanc is a free, open-source DICOM server that a dental clinic can use as its own small PACS: CBCT units and X-ray software send studies to it, and every workstation finds them in one place. The short answer for a clinic: install it on an always-on machine inside the practice network, change the default login, let only known imaging devices send to it, keep it off the internet unless it sits behind an HTTPS reverse proxy, and back up three things together — the configuration, the DICOM files and the index database.

This guide puts the official Orthanc Book guidance in the order a clinic needs it. Sources were checked on 12 October 2026. Status: Not tested yet — the steps follow the official documentation; we have not run them on a clinic network.

Orthanc in a clinic at a glance

Step 1: Choose where Orthanc runs

Orthanc’s own security page states its starting assumption plainly: out of the box it expects to run on the local machine, inside a secured environment. For a clinic that means an always-on computer or small server on the practice network, not a laptop or a public cloud VM. The Orthanc Book recommends on-premises storage with disk encryption, and local legal advice before using cloud storage.

Before you install, check that your imaging units can send DICOM (some dental software exports only its own format), and size the disk from your own CBCT studies.

Step 2: Install

Windows (most small clinics)

1. Download the 64-bit installer from the official Orthanc downloads page (the Windows quick start links to it).
2. The installer is not code-signed, so Windows may show a warning; the official guide says to choose “More info” and “Run anyway”.
3. Keep the default folders unless you have a better data disk; leave all plugins selected (unused plugins use no resources).
4. Orthanc now runs as a Windows service and starts with the computer. Open http://localhost:8042/ui/app/ and sign in with the default login given in the quick-start guide.
5. Change that default login before anything else (see Step 3).

Settings live in JSON files in the Configuration folder of the install directory; orthanc.json is the main one. Edit them as administrator, then restart the Orthanc service from the Windows Services panel. One missing comma stops Orthanc from starting.

Docker (Linux servers)

The orthancteam/orthanc image is designed for docker-compose. Any setting can be passed as an environment variable: StableAge becomes ORTHANC__STABLE_AGE, and nested settings use a double underscore. JSON files in /etc/orthanc/ and Docker secrets also work. Two defaults differ from the plain server and matter for a clinic: in this image RemoteAccessAllowed and AuthenticationEnabled are both on, and storage is at /var/lib/orthanc/db — mount that path on a persistent volume, or your images live only inside the container. Viewer plugins are switched on with variables such as STONE_WEB_VIEWER_PLUGIN_ENABLED. The Docker page of the Orthanc Book lists them all. Keep VERBOSE_STARTUP off: it can print passwords to the logs.

Step 3: Lock down the web interface

The REST API gives full read and write access to every study, including deletion. The Securing Orthanc page lists the controls; for a clinic they reduce to this checklist:

• Run the service as a separate non-administrator user.
• Keep RemoteAccessAllowed off if only the server itself needs the web interface. When other workstations need it, set it on and make sure AuthenticationEnabled is on, with real users in RegisteredUsers. Since 1.13.0, Orthanc refuses to start with remote access and authentication on but no users defined.
• Make the configuration file holding RegisteredUsers readable only by the Orthanc service account.
• Use HTTPS even on the clinic network. The Orthanc Book prefers a reverse proxy (nginx, Apache or IIS); the built-in option uses SslEnabled and SslCertificate and is meant for intranet-only servers.
• Leave ExecuteLuaEnabled and RestApiWriteToFileSystemEnabled at their default false. The documentation warns that the script and export routes could otherwise be used to run system commands or overwrite files.
• Turn off WebDAV (WebDavEnabled false) if unused, and keep LimitFindResults and LimitFindInstances above zero (the documentation suggests 100).
• Ask whoever manages the network to firewall the server so that only clinic machines reach ports 8042 and 4242.

For remote reading, never open port 8042 to the internet: use an HTTPS reverse proxy as documented, or a VPN into the clinic network.

Step 4: Let only your imaging devices send

Out of the box, Orthanc accepts DICOM C-ECHO and C-STORE from any device, but blocks C-FIND and C-MOVE from unknown ones. In a clinic you know exactly which units should send images, so list them:

1. Add each CBCT unit, panoramic unit and imaging workstation to DicomModalities with its AE title, port and IP address.
2. For each, allow only what it needs: an X-ray unit usually needs AllowStore only; a viewing workstation also needs AllowFind and AllowMove or AllowGet.
3. Set DicomAlwaysAllowStore and DicomAlwaysAllowEcho to false so unknown devices cannot send.
4. Set DicomCheckModalityHost to true so the IP address is checked. With this option on, use IP addresses, not hostnames, in DicomModalities.
5. In the imaging software, add Orthanc as a DICOM destination (server IP, port 4242, AE title ORTHANC), send a test study and check that it appears in Orthanc Explorer 2.

If studies must travel between sites, the documentation says to prefer HTTPS (DICOMweb or Orthanc peers) or DICOM TLS, supported since 1.9.0, over plain DICOM across the internet.

Step 5: Connect viewers

For browser viewing, open a study in Orthanc Explorer 2 and launch the Stone Web Viewer or OHIF Viewer; the OHIF project states that its viewer is not FDA-cleared or CE-marked. For desktop work, add Orthanc as a DICOM node in Weasis and query or retrieve studies from it. Weasis adds curved MPR along the dental arch. See also free dental imaging software.

Step 6: Back up the right three things

The Orthanc backup page is short and specific. With the default SQLite storage:

1. Stop the Orthanc service. The core assumes it is the only process using the SQLite database.
2. Copy the configuration file, the DICOM files (subfolders of the storage folder) and the SQLite index (the index* files in the same folder).
3. Restart Orthanc.

Schedule it outside clinic hours. If you cannot stop the server nightly, the documentation recommends the PostgreSQL or MySQL/MariaDB back end, which allows hot backups with that database’s own tools.

When restoring, always stop Orthanc while the database backup is restored. If the database and files were copied at different moments, the documentation suggests resending the last day of studies from the imaging units with OverwriteInstances set to true. Keep one copy off-site and test a restore on a spare machine before you need it.

When Orthanc is not the right tool

Orthanc stores and routes images. It has no charting, scheduling or billing, no implant planning and no tooth segmentation. A multi-site group needing HL7-driven worklists and tiered storage may prefer dcm4chee Archive, which runs on WildFly with LDAP and a database and is heavier to operate. For a single practice, Orthanc is the lighter start.

Limitations

• Not tested yet: this guide follows the Orthanc Book; we have not run any step ourselves.
• No medical-device claim is made by the project, and the documentation states that the Orthanc project cannot be held liable for security breaches in your deployment.
• PostgreSQL, the authorization plugin and a reverse proxy need someone comfortable with servers.
• Nothing here is legal advice.

FAQ

Is Orthanc a PACS?

It is a lightweight DICOM server that covers the core of a PACS: storage, DICOM networking, a web interface and browser viewers through plugins.

Which ports does Orthanc use?

By default 8042 for HTTP (web interface and REST API) and 4242 for DICOM.

How do I set up Orthanc with docker-compose?

Use the orthancteam/orthanc image, pass settings as ORTHANC__ environment variables, JSON files or Docker secrets, and mount /var/lib/orthanc/db on a persistent volume.

How do I change the default Orthanc password?

Edit RegisteredUsers in the configuration file, or pass it as ORTHANC__REGISTERED_USERS in Docker, then restart the service.

Can Orthanc be accessed from outside the clinic?

Only with authentication and HTTPS. Use a reverse proxy or, more simply, a VPN.

How do I back up Orthanc?

With SQLite, stop the service and copy the configuration, the DICOM files and the index together. With PostgreSQL or MySQL, use the database’s hot-backup tools.

Editorial team. Sources checked 12 October 2026.

Last updated: 12 October 2026 · DentIIT editorial team. Licence, version and platform details are checked against each developer's official documentation; none of the tools listed here should be treated as a certified medical device unless its vendor says so.