Just curious, how are images protected by login:password? The only way I know is htacess, which isn't really an easily scalable/usable feature... Many years ago, maybe 10 when I used Facebook I recall you could share a picture location with anybody regardless of login (i.e. Right click, copy image location, send over whatever), so the URL wouldn't be guessable or possible to predict, and the protection would be that you would get access to such url only when logged. I think in this context, the private network idea would only work if you are on vpn and you share urls that are only accesible vía vpn, is this a common setup for medical images? Is this expected? I wouldn't mind having a key or an image descrambler/decrypting/token but can't say the same about my grandma, my mother, my brother, my nephews...
Images are like any other web asset and can be protected either by the web server (htpasswd) or the application's logic.
I think you've been brainwashed by modern storage services (S3) where the URL is essentially always public and out of your control. It's trivial to password protect an image when it's on your server. I would assume any medical provider would protect their images by checking the session and not serve them via AWS.
Generally, no-one hosts public content on the S3. It is simply really expensive when it comes to outbound traffic. The content is usually cached and served by CDN, where you have full control over authentication and cross-origin rules.
You're right, although I would not assume anything when it comes to privacy, there are so many examples where companies did not follow best practice.
We need to move away from this model where others are in control of our private data to one where it's owned and controlled by us, giving access to service providers as needed.
