Reference table
Network requirements
Sets out the ports, addresses and bandwidth Pensieve interfaces need, with the direction of each connection and its expected volume.
Pensieve reaches a hospital's existing systems through orophin, the bridge installed on the hospital network. This page sets out the ports each interface uses, the addresses the bridge reaches, the direction every connection runs, and the volume each one carries.
The connection model
The bridge opens one connection outward to Pensieve, and every hospital system reaches the bridge across the local network. The bridge carries their messages out through that single connection, which is mutually authenticated, encrypted in transit, and shared by many interfaces at once.
One outbound path
Every connection to Pensieve begins at the bridge and travels outward, so the hospital firewall opens for outbound traffic while its listening ports stay on the local network.
Inbound interfaces
Each hospital system connects to the bridge on the hospital network. These listeners are reachable within the hospital and closed to the public internet.
| Interface | Direction | Port or path | Binds on |
|---|---|---|---|
| HL7 v2 messaging | Into the bridge | Port 2575 | The hospital network |
| Lab analyser feed | Into the bridge | Port 2576 | The hospital network |
| File drop | Into the bridge | A watched folder | The hospital network |
The outbound path
The bridge reaches two destinations, both over HTTPS on port 443. The Pensieve service carries every framed message. The Pensieve imaging store receives imaging studies directly from the hospital's imaging source, so the pixel data travels its own path apart from the framed connection. The exact addresses are supplied at installation, for the region the organisation's deployment runs in.
| Path | Direction | Destination | Port |
|---|---|---|---|
| Platform link | Out to Pensieve | The Pensieve service endpoint | 443 |
| Imaging | Out to the imaging store | The Pensieve imaging store endpoint | 443 |
Firewall rules
A site opens the rules below. The outbound rules let the bridge and the imaging source reach Pensieve; the local rule lets hospital systems reach the bridge.
| Rule | Source | Destination | Port |
|---|---|---|---|
| Allow outbound | The bridge host | The Pensieve service endpoint | 443 |
| Allow outbound | The imaging source | The imaging store endpoint | 443 |
| Allow on the local network | Hospital systems | The bridge host | 2575 and 2576 |
Bandwidth and volume
Message volume is modest for clinical messaging and concentrated in imaging. Result and order messages are kilobyte scale and frequent through the day. A batch load carries many results in one exchange. A large file drop switches to a direct upload to the store, so the framed connection stays light. Imaging studies are the largest item, and they travel their own path straight to the imaging store.
| Interface | Message size | Frequency |
|---|---|---|
| Results and orders | Kilobyte scale | Frequent through the day |
| Batch result loads | Many results in one exchange | Periodic |
| File drops | Small to large files | On a schedule the site sets |
| Imaging studies | The largest item | With each study, direct to the imaging store |
Network preconditions
A site provides the following for the bridge to run.
- A host on the hospital network for the bridge, reachable by the systems it serves.
- Outbound HTTPS on port 443 from that host to the Pensieve service.
- Outbound HTTPS on port 443 from the imaging source to the imaging store.
- Local-network reach from each hospital system to the bridge on its interface port.
- A watched folder on a local share for any file-drop interface.
Read how the bridge is set up on a site in installing the bridge.