[bcostlow]

Most PACS get data from devices and send it to workstations unencrypted. The security model implemented on them is usually no more than a white list of IP addresses the PACS will talk to. (To be fair, many of the servers have better security available now, but hospitals haven't taken advantage of it). Combine that with insecure, unsegmented networks, and hackable WiFi, and you don't need physical access to the server room.