Providing secure remote access to legacy healthcare applications

Abstract

While the widespread adoption of Internet and intranet technology has been one of the most exciting developments of recent years, many hospitals are finding that their data and legacy applications do not naturally fit into the new methods of dissemination. Existing applications often rely on isolation or trusted networks for their access control or security, whereas untrusted wide area networks pay little attention to the authenticity, integrity or confidentiality of the data they transport. Many hospitals do not have the resources to develop new `network-ready' versions of existing centralised applications. The article examines the issues that must be considered when providing network access to an existing healthcare application, and describes how we have implemented the proposed solution in one healthcare application, namely the diabetic register at Hope Hospital. The architecture is described which allows remote access to the legacy application, providing it with encrypted communications and strongly authenticated access control, but without requiring any modifications to the underlying application. As well as comparing alternative ways of implementing such a system, the article also considers issues relating to usability and manageability, such as password management.