Encrypting Traffic Between Epic and Cloverleaf

[Gerald Hodges]

Our organization is looking to encrypt internal traffic between Epic and our Cloverleaf Engine that is currently using tcpip realtime threads.

Anyone else have experience with this process?  It appears we need secure messenger along with an Epic conversion of our interfaces to use Interconnect and HTTPS.

Topic

[David Coffey]

One question: why?

[Robert Milfajt]

David Coffey wrote:

One question: why?

I can tell you our organization has batted this idea around.  The assumption being that inside the firewall is not a safe zone, given the sophistication of hackers today with spoofing, etc.  Encrypting all data transfer, either internal or external, provides another data safeguard from those hackers.

Hope this helps,

Robert Milfajt
Northwestern Medicine
Chicago, IL

[Gerald Hodges]

Robert summed it up pretty well.  Adding an extra level of security to safeguard the internal data traffic on the worst case scenario that there is a network breach.

[Jim Kosloskey]

Gerald,

I have done one SSL connection (https) and I would use Secure Messenger on the Cloverleaf side. That will suffice for Cloverleaf being the Client.

What about Epic (or other system) outbound to Cloverleaf (Cloverleaf is a Server then). Cloverleaf natively does not do https Server well (by design). For that you would need CAA-WS I think.

Can’t Epic do Secure TCP/IP (would mean you don’t need to consider CAA-WS)?

I don’t know what needs to be done on the Epic side.

But aren’t there also other systems exchanging messages? Can they all support Secure TCP/IP or https?

What about files – will you be using SFTP or FTPS (Cloverleaf with Secure Messenger supports both)?

I suspect you will have some outlying systems (systems which cannot do secure exchanges). If that is the case then from a security standpoint wouldn’t you still have a hole?

Well that is my contribution for what it is worth.

email: jim.kosloskey@jim-kosloskey.com 29+ years Cloverleaf, 59 years IT - old fart.

[Gerald Hodges]

We confirmed this morning that EPIC currently does not have any security options for their tcp-ip connections so we would not be able to use the ssl options on our tcp-ip threads.  They consider those types of interfaces behind a firewall.

HTTPS(Epic Interconnect) appears to be the only transport method with additional security available with Epic for real time hl7 message handling that is intended for transmission outside of the firewall.  

We are still investigating if all of the interface types in Epic can use Interconnect.

[Mark Thompson]

Can you do this at the network level?  Your network team may be able to provide a private VLAN for interface communication.  Network switch technology can limit where communication is “visible” within your internal network.  Getting all of my application vendors to implement secure communication would be a sizable task.

- Mark Thompson
HealthPartners

[Bob Schmid]

Gereald,

Just presented yesterday with the EPIC 2018 initiatied to go interconnect https to us for their document interfaces.

We have secure messenger but not CAA

Was there a solution that you came up with?

Thanks for any wisdom / experience you might be able to convey

Bob

[Author]

Replies