Introduction

This document is written for IT staff / system engineers of data providers and therefore assumes technical knowledge. It acts as a guide through the on-boarding process of HD4DP v2 and covers installation of the server, user configuration, network configuration and remote access.

The order of steps in this document should be respected during execution.

Overview

HD4DP v2 consists of a modular application stack, which allows healthdata.be to seamlessly upgrade individual elements.

An HD4DP v2 deployment comprises of following components:

• Form.io component
• MongoDB
• PostgreSQL
• Nextgen Connect

As it is the case in HD4DP 1.0, an Encryption Module with a connection to the eHealthBox is still required for HD4DP v2 and must be provided by the data provider.

Network configuration

IP

The HD4DP server needs to be accessible via domain names in DNS, and must have a static IP in your private network.

DNS

The application stack of HD4DP v2 requires four domain names pointing to the IP of the locally installed HD4DP v2 server. Use the following names in your DNS:

• nextgenconnect.hd4dp.<yourdomain.be>
• hd4dp.<yourdomain.be>
• metabase.hd4dp.<yourdomain.be>
• admin.hd4dp.<yourdomain.be>

Firewall

The following connections should be possible in the firewall flow:

• To and from (a) machine(s) in your IT department on port 22 for initial configuration and local support.
• To and from the Encryption Module server. The protocol and ports depend on your local EM implementation. Contact your EM vendor if more information is necessary.
• Reachable by your staff who uses HD4DP, on ports 80 and 443 for HTTP(s) traffic.
• To and from the LDAP server (this is not mandatory if you are not using LDAP to authenticate) (port 389 by default)

The healthdata.be proxy server is used as a gateway to the internet for the security of HD4DP servers. The configuration of this proxy server will be provided to you by healthdata.be at a later date.

Server installation

To install the application stack of HD4DP v2, healthdata.be requires a fresh installed operating system, specifically Ubuntu Server 18.04 LTS.

Please use these instructions even if you have previous experience with installing this operating system, as its configuration is specific for healthdata.be.

These instructions assume that the network configuration described in the previous section is completed.

Instructions

HD4DP v2 requires a (virtual) machine running Ubuntu Server 18.04 LTS.

We assume knowledge of loading a .iso file onto a (virtual) machine. Healthdata.be can’t provide instructions for this, as the environment of your center is unknown. Should you have any trouble, however, please contact Healthdata.be support so that we can help out.

Please find the installation steps below.

Installation steps

1. Download the .iso file from the link below.
   Download Ubuntu Server 18.04 LTS
2. Create a new (virtual) machine with Linux Ubuntu 64 bit as the OS family
3. When prompted, select the .iso file downloaded in step 1.
4. After some time, you will be prompted to select a system language. Select English.
5. “Keyboard configuration”
   Select your preferred keyboard layout and press enter
6. “Network Connections”
   Highlight the network interface and press enter. Navigate as follows:
   Edit IPv4 -> Manual -> enter the network details -> save -> Done
7. Proxy IP -> Leave default/empty.
8. “Configure Ubuntu Archive Mirror” -> leave default
9. “File system Setup” -> Use An Entire Disk
10. Proceed until “Confirm destructive action” -> press continue. The installation process starts, this can take several minutes.
11. In the meantime, create the user for Healthdata.
    username = healthdata,
    Password = choose a secure password and communicate it to healthdata.be.
12. Mark “Install OpenSSH server”. This will be used for remote access. “Import SSH Identity” -> no -> done
13. “Featured Server Snaps” -> Select nothing and press Done.
14. Wait until installation is finished.

Configuration steps

Connecting to the server

Log into the machine with the healthdata.be user created in the previous section.

Instructions (from a Windows machine):

1. Install the tool Putty and open the application.
2. On the configuration screen, enter the following (replace cursive text with the appropriate values)
   • Host Name: healthdata@server_private_ip
   • Port: 22
   • Connection type: SSH
3. Click Open. Enter the password (you will not see text as you type, you can paste into putty by right-clicking in the terminal).
4. You should now be logged in and see a prompt  “healthdata@server_name:~$”

Administrator account for internal use

An administrator account for internal use can be created on the HD4DP v2 server.

The configuration of remote access (described below) should not happen on this account, but on the Healthdata.be account.

The internal account can later be used to install and configure OS monitoring software and antivirus software by the internal IT team. For more information, see the section on Antivirus and Monitoring.

(Text with a gray background should be entered as a command in the terminal of the server)

Create the user:

            sudo adduser <username>

Add the user to the sudo group

            sudo usermod -aG sudo <username>

Installation and configuration of the software stack

Healthdata.be support will instruct you when to execute the next step, which is to enable remote access so that Healthdata.be can execute the software installation and configuration.

Backups

The configuration of the HD4DP v2 server is administered by healthdata.be and does not require backups.

HD4DP v2 regularly dumps its databases automatically to the /backup directory on the server. A network storage should be mounted at this location.

Please fill out the infrastructure sheet with the required credentials, domain name/url, protocol… to connect to the network drive. The connection will then be configured by healthdata.be.

Patching and Updates

Healthdata.be configures HD4DP v2 servers to automatically receive recommended security updates. The choice for Ubuntu 18.04 is motivated by the long-term support for this version. Security flaws are rare in this distribution, and security updates are quick and often don’t require a system reboot.

If the IT department of your organization prefers to manage patches, this is possible but not encouraged. Please use the account for internal use created in Section 3 for this purpose.

Antivirus and Monitoring

Most data providers will want to manage their own antivirus and OS monitoring on all machines in their network. Installation of such software on the HD4DP v2 server is allowed, but healthdata.be should be informed about all extra software installed on the server. Additionally, healthdata.be will not provide support for the installation of this software.

Contact information

The HD4DP v2 Infrastructure Sheet contains information that healthdata.be needs in order to start the insallation of the HD4DP 2.0 Software at your organization.

Below you can find the description of the necessary information:

SERVER CONNECTION

Healthdata.be performs its installation and support tasks remotely (using VPN or remote port forwarding via SSH). Please provide the required credentials.

• Type of connection (VPN / Remote port forwarding via SSH)
• Link (IF VPN)
• Username, token, other (if VPN)
• Password (if VPN)³
• Public SSH Key (if remote port forwarding)

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

SERVER MACHINE

• Server Name
• Internal IP-Address
• Ram (in GB)
• CPU (number of CPU's and number of cores)
• Disk space (in GB)
• Username: Healthdata
• Password ³

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

ATTACHED DRIVE FOR BACKUPS

HD4DP 2.0 regularly performs data dumps for backup purposes. Please provide connection information to a network share volume.

• Link / IP address
• Path
• Username
• Password ³

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

USER MANAGEMENT

HD4DP can either connect to a LDAP server or use its own application database for performing user authentication and management. Please check the user management mechanism you want to use.

• LDAP user management : Yes / No
• Application user management : Yes / No

LDAP configuration (Optional)

If you chose ‘LDAP user management’ as user management mechanism, please provide the following information that allows us to connect to your LDAP system.

• Connection URL
• Username
• Password³

³ For security reasons, we advise to communicate passwords to us either by phone, or via a link using a secret-sharing service such as onetimesecret.com.

SOFTWARE CONFIGURATION

Encryption Module interface

HD4DP communicates with the Encryption Module (EM) either using the file system interface or by calling a REST web service. Please choose which interface HD4DP should use for its communication with the Encryption Module.

Note: if the encryption module is not yet purchased (or developed), HD4DP can already be installed; the EM can then be configured in HD4DP once it is available. Please note that HD4DP 1.x and HD4DP 2.0 cannot use the same EM.

• REST web service
• File system

REST web service interface

If you chose to communicate with the Encryption Module using a REST interface, please provide the web service URLs that should be used by HD4DP for its communication with EM.

• "Outgoing flow URL: Example: http://host:8080/encryptionmodule/send"
• "Incoming flow URL : Example: http://host:8080/encryptionmodule/receive"

File system interface

• "Incoming directory: Directory where HD4DP checks for incoming files"
• "Incoming directory: Directory where HD4DP writes outgoing files"
• "Incoming directory: Directory to which HD4DP moves successfully processed files"
• "Incoming directory: Directory to which HD4DP moves unsuccessfully processed files"

This documentation details the necessary adaptations to be performed in order to allow the necessary technical accesses and smooth operation of the different healthdata.be platforms and interfaces.

The file is available for download below.