How to Send Scans, STL and CBCT Files to Your Dental Lab Safely

It is 4:40 pm. Tomorrow's surgical guide case needs the full-arch scan and the CBCT at the lab tonight, the portal says "upload failed" for the third time, and someone at the front desk says, "Can't we just WeTransfer it?" The answer you give in that minute decides where a patient's files end up, so it is worth settling before the next bad afternoon.

This guide is for the office manager or assistant who sends cases every day. It sits under our guide to the digital dental workflow, from the IT side, and the computers and accounts behind it are part of dental IT support. Sending images to or from a referring dentist is a different job, covered in sending CBCT scans and X-rays to a referring dentist. Here you get a file table, a decision table, a portal check, troubleshooting steps and a one-page SOP.

What counts as patient data in a lab case?

Anything in the case that can be tied to a patient: the intraoral scan, the CBCT, photos, the digital Rx and often the file name itself. A 3D model is just a mesh until it is saved as "Garcia_Maria_UL.stl" or attached to a chart. From then on, treat it the way you treat an X-ray in the practice software.

Here are the files that usually travel with a crown, bridge, denture or implant case, and where the stray copies come from.

Two sources sit behind the size column. A 2024 comparison by the Institute of Digital Dentistry exported crown-prep scans at 4.8 MB to 24.9 MB as STL, depending on the scanner. A 2026 study of 1,800 scans in the Journal of Dentistry found PLY files 50% to 62% smaller than the same scans as STL when colour was not stored. For CBCT, one radiology reading service lists small field-of-view exports at 50–150 MB, medium at 150–400 MB and large at 400 MB to 1 GB, and warns that an export under 20 MB may be incomplete.

The habit to build: every file in this table has one approved route out of the office (next section) and one place where local copies are deleted (H2 on exported files below). If you are checking the rest of your privacy setup at the same time, use the HIPAA checklist for dental practices.

HIPAA file sharing for dental labs: which ways of sending a case are OK?

Labs often suggest WeTransfer, Dropbox or OneDrive when a portal upload fails. Whether that is OK depends on the plan, a BAA in place with the vendor and the sharing settings, not on the tool's name. The table below gives a verdict for each route an office actually uses, and the condition that verdict depends on.

Read the table from the top. The first two rows should carry nearly every case. Row 3 is the fallback when a portal is down, and only if the BAA and link settings are already in place before the bad afternoon. Email is for small files, and the setup behind it is covered in our page on email security for dental offices.

Not sure which of these routes your office actually uses? A Free Dental IT Assessment gives you written findings and prioritized recommendations on your computers, software, network security, backups and performance.

Which vendors sign a BAA, and where does the lab fit?

The vendors that store or move your files for you are the ones whose BAA you check: scanner clouds, cloud drives and email. Several publish how their BAA is offered and accepted. The lab's position is set by the HHS rules quoted below, and how they apply to your practice is a question for your privacy officer or attorney.

A business associate agreement (BAA) is the contract HIPAA expects between a practice and a company that handles patient information on its behalf. Here is what each vendor's own page says about its BAA, as read in October 2026.

What the rule text says. The HHS definition of a business associate, 45 CFR 160.103, includes "a Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information," and "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate." The same definition says a business associate does not include "a health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual."

HHS's FAQ "When is a health care provider a business associate of another health care provider?" (last reviewed January 9, 2023) says a covered entity may share information with a provider for treatment "without a business associate contract," and that a separate business associate relationship can exist when one provider does something else for another. The FAQ does not mention dental labs.

HHS's cloud computing guidance (last reviewed December 23, 2022) adds a point about storage services, where a CSP is a cloud service provider: "Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules."

Ask your privacy officer or attorney how this applies to your practice; many practices sign a BAA or confidentiality agreement with their labs anyway. If you want help putting the policies and records side in order, see HIPAA compliance support for dental practices, and for what changed in the Security Rule recently, read our summary of the HIPAA Security Rule updates.

The IT action in this section is not legal at all: find each signed BAA and its date, and write down who in the practice holds the account where it lives. In many offices nobody can say who clicked the 3Shape checkbox, and that person may have left.

Is 3Shape Communicate (and other scanner portals) secure enough?

3Shape Communicate is the cloud service many TRIOS offices use to send cases to the lab. 3Shape's safeguards page lists unique logins, role-based access, TLS 1.3 encryption, encryption at rest, access logging, a 15-minute auto logoff and 30-day backups. The page does not mention MFA, but 3Shape's separate MFA user guide shows that 3Shape Account offers it as an option, by authenticator app or email code: turn it on in each 3Shape Account under Personal settings (Two-step verification). Some single sign-on accounts cannot use it.

What 3Shape says on its own pages, dated 2024:

• • Users "are managed and authenticated through 3Shape Account, ensuring each user has a unique ID," with role-based access control.
• • The website and iOS app "automatically log off after 15 minutes of inactivity."
• • Communicate "uses TLS 1.3 AES-256 encryption," and "all personal information is encrypted at rest."
• • Logging records "every instance of access to patient data."
• • Backups "are retained for 30 days."
• • 3Shape acts as a business associate for Communicate, Unite Cloud, Cloud Storage and Lab Management Software, accepted by checkbox at company level.

Those are the vendor's controls. The ones you run are the accounts. Use this six-line check on every scanner or lab portal your office touches: 3Shape Communicate, MyiTero, Medit Link, DS Core or Connect Case Center, and each lab's own site. These are systems your practice runs; your IT provider keeps the computers, network, backups and accounts around them working, and the vendor or reseller supports the application.

One more thing to check in 3Shape: who holds the company-level 3Shape Account. 3Shape says the BAA is accepted at that level and that the signed BAAs and their dates are stored there. If the only person with that login is a doctor who sold the practice, or an assistant who has left, fix that before anything else.

Is Dropbox OK for patient scans?

Dropbox can be used for patient files only on certain team plans, after a team admin signs Dropbox's BAA in the admin console and before any patient file goes in. Then sharing, deletion settings and connected apps need locking down. A personal or free Dropbox account is not an option, because those plans are not on Dropbox's BAA list.

Dropbox's own help article (updated September 16, 2025) says its BAA applies to "certain teams on" Dropbox Standard, Advanced, Enterprise, Education, Business, Business Plus and Dropbox Sign, and that "a BAA must be in place before you transfer PHI into your Dropbox account." It adds four details that matter to an IT setup:

• • E-signing the BAA in the admin console is available only to US-based customers.
• • A team that signs a BAA can't enable reseller support, so if a reseller manages your Dropbox, talk to them first.
• • Dash, including Dash in Dropbox, is not covered.
• • Third-party apps connected to Dropbox are not covered by the BAA.

Box, OneDrive and Google Drive

• • OneDrive or SharePoint (Microsoft 365): Microsoft says its BAA comes through the Data Protection Addendum for in-scope services. Have your IT admin restrict public links before any lab sharing.
• • Box: check Box's own BAA page for which plans qualify, and get it in writing.
• • Google Drive (Google Workspace): the same; a personal Google account is not the place for patient files. The Workspace email side is covered in email security for dental offices.

Can we send scans by WeTransfer?

Not for identifiable scans. HIPAA Journal reported in January 2025 that "WeTransfer will not enter into a HIPAA Business Associate Agreement with healthcare customers," and WeTransfer's own healthcare page offers no BAA. Running WeTransfer from inside Dropbox does not change that, according to the same article.

WeTransfer's healthcare page describes it as a Dutch company and points business customers to data processing agreements rather than a BAA. That is the vendor's position, and it is why the free transfer row in the decision table says "avoid."

The real problem is that at least one lab's own help page still tells dentists to use WeTransfer when its portal fails. So the fallback has to be written down before the next failed upload.

Why won't the scan or CBCT send?

Usually because the file is bigger than the mailbox allows, the upload is slow or blocked, or the portal session timed out. A medium CBCT export of 150–400 MB is several times the 35 MB default send limit in Microsoft 365 and the 25 MB personal Gmail limit, so it needs a portal or a link, not an attachment.

The worked example. Take a 400 MB medium-field CBCT export (the top of one radiology service's medium range).

• • Microsoft 365: the default maximum message size is 35 MB to send and 36 MB to receive; an admin can set 1 MB to 150 MB. Messages routed outside Microsoft's datacenters are subject to an extra 33% encoding increase, so a message to an outside lab is bigger in transit than the file on your desktop.
• • Personal Gmail: 25 MB. Above that, Gmail swaps the attachment for a Google Drive link, which is a personal cloud share with your patient's file in it.
• • Upload time (arithmetic, not a vendor figure): 400 MB × 8 = 3,200 megabits. At 10 Mbps upload that is about 320 seconds, roughly 5.3 minutes. At 3 Mbps, about 18 minutes. Protocol overhead and other traffic make the real number longer.

An intraoral scan of 5 MB to 25 MB may squeeze under a mailbox limit, but that does not make email the right route (see the decision table). Bandwidth for the scanner itself is covered in the guide to intraoral scanner IT requirements.

If the same case keeps failing on the same PC while others upload fine, the fault is on that PC or its connection. When the imaging software and the practice software stop handing files to each other, see imaging integration troubleshooting.

Shared lab logins and staff turnover: who can still see your cases?

In many offices, one login is shared by everyone who sends cases, on several portals, and the password has not changed since the scanner was installed. When an assistant leaves, that person can still sign in from home. Every portal account should belong to one person and be removed on their last day.

Build a one-page lab-access inventory and review it each quarter and every time someone leaves.

Three rules make the inventory work:

1. 1. No shared accounts. If a portal charges per user, that is a cost question, not a reason to share.
2. 1. MFA where offered. Where the portal does not say, ask the vendor and record the answer.
3. 1. Exit day is the deadline. Add every portal on this sheet to your offboarding steps. Our offboarding checklist has the rest of the list, and password management for dental offices covers where the credentials should live.

Accounts, MFA and offboarding are part of dental cybersecurity services; the inventory above is yours to keep either way.

Where do exported scan files end up, and how do you clean them up?

Every export leaves a copy: in the scanner's export folder, on the desktop, in Downloads, on a USB stick. Cases that only live in a vendor cloud are not in your own backup either. Set one export folder per PC, decide whether it is backed up, and delete local copies once the lab has accepted the case.

Ask your vendor how long cases stay in its cloud and whether you can export them. If a case only exists there, your backup plan does not cover it; see dental backup and recovery. The PCs themselves, including where scanner software saves by default, are covered in scanner and CAD PC requirements.

The one-page "How we send a case" SOP

Print this, change the names to your own systems and pin it beside the scanner. It turns the decision table into ten steps anyone on the team can follow at 4:40 pm.

1. 1. Rx complete. Every field the lab needs is filled in before anything is sent.
2. 1. Route chosen. Use the approved route for this file type and this lab (scanner connection or lab portal first).
3. 1. Named login. Sign in as yourself, never as "office."
4. 1. File name. Use the case ID instead of the patient's name where the lab allows it.
5. 1. Only what the lab needs. Send the scan, CBCT and photos the case requires, not the whole patient folder.
6. 1. Send. Through the approved route only.
7. 1. Confirm receipt. Check the portal or ask the lab to confirm the files opened.
8. 1. Log it. Note the date, route and files in the practice software.
9. 1. Delete local copies. Remove the export from the desktop, Downloads or USB once the lab accepts the case.
10. 1. Escalate failures to IT. If the upload fails twice, follow the fallback steps above and call IT; never improvise with a free transfer site.

What goes in a digital lab Rx?

Fields only, because each lab issues its own form: patient identifier or case ID, doctor, tooth numbers, restoration type, material, shade, margin and contact notes, due date, and a list of every attachment sent (scan, CBCT, photos, bite record). The attachment list is the line that tells the lab, and you, whether anything went missing.

What should you ask your lab and your IT provider?

Ten questions, each with what a good answer sounds like. Ask them in writing and keep the replies with your vendor records.

For the wider list of questions to put to any IT company, use 20 questions to ask before signing with a dental IT provider.

The bottom line

Send cases through the scanner's lab connection or the lab's portal, with a named login per person. Have one fallback ready, with a BAA in place before the bad afternoon. Keep email for small files, never use free transfer sites for identifiable scans, and delete the local copies once the lab has the case.