Skip to content
§
§ · build vs buy

Build vs Buy: Medical Image Exchange and Vendor Neutral Archive Platforms

A single hospital with one archive and occasional outside discs should buy. Ambra Health or Nuance PowerShare will cost less than a build and the network effect is real where both facilities are members.

Custom Software Development architecture and database illustration for Medical Image Exchange Build vs Buy Guide.
The short answer

A single hospital with one archive and occasional outside discs should buy. Ambra Health or Nuance PowerShare will cost less than a build and the network effect is real where both facilities are members. Build when you receive transfers from many non-member facilities, run several archives after acquisitions, or watch radiologists ignore outside studies that sit in a second viewer behind a second login.

Buying wins wherever the network already covers the relationship

An exchange network is worth more than any code you can write for the facilities that are already on it. If your three highest-volume referrers all sit on the same platform you do, studies arrive without a disc, without a courier and without a film library technician, and no custom build improves on that. Pay for membership and stop.

The same logic holds for a single hospital with one picture archiving system, one reading environment and outside studies arriving a few times a week. A cloud exchange service plus a straightforward vendor neutral archive from Sectra or Hyland will serve you, and building infrastructure to solve an occasional problem is a poor use of capital that could go into a reading room.

Buy too if your imaging informatics function is one person. Somebody has to own morphing rules, reconciliation thresholds and retention policy after go-live, and a custom platform with no internal owner degrades into a black box within a year. Products at least come with a support number.

There is one more case for buying that people talk themselves out of. If your organisation is mid-way through consolidating onto a single reading platform, defer. Every downstream filing convention you would encode this year changes when the consolidation lands, and you would be building against a target that moves twice. Join a network, absorb the friction for eighteen months, and start the build from a settled architecture.

And be honest about what your incumbent already does well. Vendor neutral archives all support tag morphing, exchange platforms all offer a reconciliation queue, and both work. The question is not capability. It is who controls the rules and who is awake when the rules need changing.

Building wins at the boundary, which is where the money leaks

It is ten past two in the morning and a trauma transfer is inbound. The referring facility scanned the patient ninety minutes ago. The images are on a disc in a bag or theoretically in a network the referring site may not have pushed to. The receiving team can spend twenty minutes trying to import and reconcile an outside study, or rescan. They rescan. The patient takes a second dose, the health system absorbs the cost, and everyone involved knows it was avoidable.

That gap exists because reconciliation is a human queue that runs during business hours. An outside study arrives carrying the sending institution's medical record number, accession number and naming conventions, and matching it to your patient is the one decision that determines whether the study is useful or dangerous. Build when you want high-confidence matches reconciled automatically against your master patient index, the ambiguous band routed to whoever is genuinely on shift with images viewable, and anything below the lower threshold quarantined so it never touches a chart.

Build when your tag morphing rules are vendor-managed configuration. This is the detail buyers underestimate: when a new referring facility starts sending studies with unfamiliar series descriptions, adjusting the mapping is a service request, and while it sits in a queue the studies file incorrectly and radiologists build workarounds that outlive the fix. A rule set that your own informatics team versions, tests against sample studies and deploys the day a referral relationship starts is a different operating posture entirely.

Build when you run multiple archives after acquisitions and no single view of a patient's imaging exists, and build when outside studies live in a separate viewer that nobody opens during a busy shift. A study that requires a second application is functionally invisible exactly when a prior matters most.

What each path really costs

Exchange services generally price per member site or per study transferred, sometimes both, with the archive priced on stored volume. That structure is fine while your transfer volume is modest and uncomfortable once you become a regional receiving centre, because your bill rises with precisely the activity you were trying to make cheaper. Ask any vendor to quote at double your current study volume before you sign.

On the build side, Digital Heroes delivery experience puts a focused first release at $90,000 to $190,000 shipping in 12 to 20 weeks. That covers multi-channel study intake including discs and network sources, identity reconciliation with an explicit confidence model and an on-shift exception queue, and a tag morphing engine your team controls. A full platform adding worklist injection, routing by service line, retention policy by modality and body region, outbound sharing with authorisation, and legacy archive migration runs $250,000 to $700,000 phased across 9 to 18 months.

Storage and egress are a separate line on both paths and deserve modelling over five years, not one. So does the run rate: 15 to 20 percent of build cost annually covers hosting, monitoring, morphing rule maintenance and interface upkeep. The way to keep the first number down is to start with intake, reconciliation and worklist injection for your top ten referring facilities, which usually covers most transfer volume and produces the repeat imaging reduction that funds everything after it.

The costs that ambush this project

Migration is the one. Legacy archives are never designed to be exited gracefully, and the schedule driver is almost never your new platform. It is the retrieval throughput the old system can sustain while remaining in clinical use. Measure that rate before you commit to a date, because a quoted twelve-week migration against an archive that can only serve a fraction of your daily volume is arithmetic that will not work.

There is a structural conflict of interest in asking your incumbent archive vendor to help you leave, and it shows up as migration services quoted as a modest line item, delivered late, and finished with a residual set of studies nobody can account for. Inventory every study at source before transfer so you know the denominator, verify per study by identifier and image count, and keep an exception register. Anyone who describes migration as a copy has not done one.

The second ambush is master patient index quality. Reconciliation accuracy is bounded by the index you match against, so if your index carries duplicate and overlaid records, budget remediation work that has nothing to do with imaging.

Third, outbound release. Patient-directed sharing adds identity proofing and a support path for people who are not employees, which is a small product in its own right. Information blocking rules also raise the stakes on refusing legitimate requests, so this is not scope you can defer indefinitely.

Fourth, the discs themselves. Small imaging centres still burn media, and those discs carry inconsistent directory structures, occasional missing metadata and study descriptions written by whoever was on the console. A build that assumes clean network transfers will meet reality in its first month. Automated classification has one honest and narrow use here: proposing a modality or body part when the tags are missing or plainly wrong, for a human to confirm rather than to accept silently.

The 2am transfer test

Run this on a real week rather than a hypothetical one. Take every outside study your organisation received in the last seven days and answer four questions.

How many arrived outside business hours, and what happened to them? If the honest answer is that they waited for the film library to open, and some patients were rescanned in the meantime, you have quantified the leak.

How many required a human to decide which patient they belonged to, and how long did that decision take? Anything above a small minority means your matching is manual by default rather than by exception.

How many came from facilities that are not on your exchange network? That share is the part of the problem membership will never solve, and in most health systems it is the majority of transfer volume.

Finally, ask two radiologists how often they open the outside viewer during a shift. If the answer is rarely, then whatever you have bought is not being used, and buying more of it will not change that.

Two uncomfortable answers justify a build scoped to intake and reconciliation. Four justify the full platform, and probably a migration alongside it.

The first two moves

Measure the two numbers that decide everything: your legacy archive's sustained retrieval rate, and the share of inbound studies from non-member facilities. Both are obtainable in a fortnight and both will change the shape of any proposal you receive.

Then interview on specifics. Ask a candidate how they decide a study belongs to a patient, and expect weighted demographic comparison across name, date of birth, sex and available identifiers with an explicit threshold, not exact matching. Ask who owns the morphing rules after go-live, because if the answer is the developer you have recreated the vendor queue with a new logo. Ask what they will do to verify a migration. Ask about DICOM specifically: query and retrieve behaviour, DICOMweb services, study instance identifier handling and the realities of discs burned by small imaging centres.

Digital Heroes runs this work PRD-first, so the confidence thresholds, the quarantine behaviour and the rule ownership model are written and agreed before code exists, which matters in a category where a quiet wrong guess is a patient safety event. The team is 50-plus people across 2,000-plus delivered projects, holds Fiverr Vetted Pro status, and works in public, including a YouTube channel with 2.5 million subscribers. Contracting runs through an India LLP, US LLC or UK LTD so IP assignment sits under your own law. Keep the exchange network for the relationships it covers. Build the layer that handles everyone it does not.

If you want a second opinion before signing anything, Digital Heroes writes a product requirements document before any code exists, so the scope is fixed and priced rather than discovered later at a day rate. You keep the specification either way.

Research & sources

The evidence behind this guide

Independent findings on why this investment pays off. Every link goes to the primary source.

  1. Only 22% of firms are 'future ready' having significantly transformed digitally; these companies show average revenue growth 17.3 percentage points and net margins 14.0 percentage points above their industry average. Source: MIT Center for Information Systems Research (MIT Sloan) (2022) →
  2. The 2015 CHAOS data (based on the modern definition of success) reports that only about 29% of software projects succeed, 52% are challenged, and 19% fail, with the three most important success skills being executive sponsorship, emotional maturity, and user involvement. Source: The Standish Group (reported via InfoQ Q&A with Jennifer Lynch) (2015) →
  3. Across ten outpatient clinics the mean no-show rate was 18.8%, and the marginal cost of no-shows reached $14.58 million per year for those clinics, at roughly $196 per missed appointment (2008 figures). Source: BMC Health Services Research / PubMed Central (Kheirkhah et al.) (2015) →
  4. In an RCT, the no-show rate was 23.5% for patients receiving a text-message reminder versus 38.1% for the control group - a 14.6 percentage-point reduction (p = 0.04). Source: Clinical Pediatrics / PubMed Central (Lin et al.) (2016) →
FAQ

Frequently asked questions

How much does a custom image exchange or VNA layer cost to build?

A focused first release covering multi-channel intake, identity reconciliation against your master patient index with a confidence model, and a tag morphing engine your own team controls runs $90,000 to $190,000 across 12 to 20 weeks in Digital Heroes delivery experience. Adding worklist injection, routing, retention policy, outbound sharing and legacy migration takes it to $250,000 to $700,000 over 9 to 18 months.

How long does a PACS or archive migration realistically take?

Longer than it is quoted, and the constraint is the retrieval throughput your legacy archive can sustain while staying in clinical use, not anything on the receiving side. Measure that rate before agreeing a date. A verifiable migration inventories every study at source first, transfers continuously, verifies per study by identifier and image count, and maintains an exception register for whatever did not arrive.

What happens to our existing studies and metadata during migration?

They are inventoried, transferred and verified rather than copied. Expect a residual set that fails validation for real reasons: corrupt series, studies with no resolvable patient, duplicates created by an old overlay. Those go into an exception register worked by a named person rather than quietly dropped. Plan for that queue explicitly, because it is the difference between a clean cutover and a permanent asterisk.

Can outside studies appear directly in the radiologist worklist?

Yes, and it should be the goal of the whole project. Once reconciled and normalised, the outside study receives an accession in your namespace, files to your archive and presents as a prior alongside the current examination. Formal outside reads enter the worklist as work items with the correct service line and turnaround expectation. Success is the radiologist never needing to know the study came from elsewhere.

Who needs to run this internally after launch?

One imaging informatics owner for morphing rules, reconciliation thresholds and retention policy, plus whoever staffs the exception queue, which should be people already on shift rather than a dedicated team. The critical staffing change is moving reconciliation out of business hours. If the queue is only worked between nine and five, the overnight transfer problem you built this to solve remains exactly where it was.

Who actually builds image exchange and archive platforms like this?

Digital Heroes builds custom platforms in this space and suits health systems for concrete reasons rather than adjectives. The process is PRD-first, so confidence thresholds, quarantine rules and morphing rule ownership are agreed in writing before code. The team spans 50-plus people and 2,000-plus delivered projects, and the India LLP, US LLC and UK LTD structure means contracting and IP assignment happen in your own jurisdiction.

What makes Digital Heroes different from a generic dev shop for this work?

A generic shop will implement exact matching on name and date of birth and call reconciliation done. The concrete difference here is a design that scores matches, reconciles only above a defined threshold with full logging, routes an ambiguous band to whoever is on shift with images viewable, and quarantines below it. Building a system that is willing to say it does not know is a deliberate architectural choice.

How do we verify a development partner before committing budget?

Check D-U-N-S registration to confirm the entity is real and traceable, then read the public Clutch and Trustpilot profiles instead of testimonials on the vendor's own site. Ask which entity signs and in which country, and require the repository and cloud storage accounts in your organisation's name from the first commit. Then ask how studies would be extracted in bulk if you replaced the system.

How do I make sure custom software is secure and compliant with rules like HIPAA?

Start with the baseline every business system should have: encryption in transit and at rest, role-based access control, and audit logs. If HIPAA applies, the hosting provider must sign a Business Associate Agreement, which AWS, Azure, and Google Cloud all offer, and access controls have to be designed in from day one, not bolted on. SOC 2 certifies a company's operating practices, not a codebase, so ask vendors what they have shipped in your regulated domain rather than which logos are on their website.

Can custom software connect to the tools we already use, like QuickBooks, Stripe, and Google Workspace?

Yes, and connecting your existing tools is one of the main reasons to build custom: mainstream platforms like QuickBooks, Stripe, Shopify, and Google Workspace all publish documented APIs. Budget 1 to 3 weeks of work per integration depending on API quality and how much data flows in both directions. Ask any vendor whether they have integrated with your specific tools before, because quirks like QuickBooks' OAuth token handling and API rate limits get learned on someone's project, and it should not be yours.

Does it matter which tech stack the agency wants to use?

Yes, but not in the way most buyers expect: the goal is boring, popular technology such as React, Node.js or Python, and PostgreSQL, because any future team can maintain it and hiring a replacement developer takes days, not months. The red flag is an agency-proprietary framework or an unusual language, which welds you to that one vendor no matter what your contract says about code ownership. A useful test: could you find three freelancers fluent in this stack within a week? If not, push back.

How do I vet a software development agency before signing a contract?

Ask to speak with two past clients whose projects resemble yours in size and industry, and ask exactly who will write your code, since some agencies sell senior faces and deliver junior or subcontracted hands. Demand a written specification with acceptance criteria before any fixed price, and check that their portfolio links to products that are actually live. An instant quote given without questions about your workflows is the clearest warning sign there is.

How many people should be working on my software project?

A typical $40,000 to $150,000 build runs on three to five people: a technical lead, one or two developers, a designer, and someone owning QA and project communication, often as overlapping part-time roles. More bodies do not make software arrive faster; past a point they slow it down with coordination overhead. The question that matters more than headcount is whether one named senior engineer is accountable for the outcome.

If we build for 20 users now, will the software cope with 500 later?

It should, without a rewrite, if it was built on a standard cloud stack; going from 20 to 500 users is mostly a hosting configuration change costing hundreds a month, not a second project. What actually breaks under growth is sloppier work: database queries never indexed for volume and features designed assuming one office's worth of data. Before signing, ask the vendor what happens to the system at ten times today's data, and listen for a specific answer.

What are the biggest mistakes first-time software buyers make?

Choosing the lowest bid, paying more than 30-40% upfront instead of on milestones, skipping a written specification, and having no maintenance plan for after launch. The most expensive of the four in Digital Heroes rescue projects is the missing spec: without written acceptance criteria, done becomes an argument instead of a checklist, and every disagreement resolves in the vendor's favor. Fix those four and you have avoided most of the ways these projects fail.

Who can build a custom software system?

Digital Heroes builds custom software systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.

Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.

What makes Digital Heroes different from other software companies?

Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.

Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.

How can I check Digital Heroes is legitimate before getting in touch?

Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.

Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.

Keep reading

Published · Last updated .

Online now

Hi there. How can we help you today?

Reply