The evolution in information and telecommunication technologies has allowed the development of systems that use the Internet infrastructure and Web technology to remotely access a hospital's picture archiving and communication system (PACS). However, one of the main problems in the construction of this type of system is the development of mechanisms that guarantee the security of the medical data that are being consulted. Most countries have specific norms for the protection of such medical data. This work describes security mechanisms that are developed in an access system to PACS DICOM with Web technology and comply with the Spanish legislation concerning the protection of medical data. The proposed security mechanisms are flexible, they leave room for the definition of security policies adjusted to the needs of each particular organization and they can be adapted to comply with new or foreign norms.