In large installations of a Picture Archiving and Communication System (PACS), data protection becomes an issue. Above all, not every employee should have access to all data stored in the system. At the Freiburg University Hospital, we developed a concept of dynamic assignment of authorization, assuring that every physician is authorized to the data of all patients under his care. We describe the technical implementation of data protection developed for the integration of PACS and electronic patient records in Freiburg. The system was installed in January 2001 and the experience of its two years in operation is reported.