Reference table
Connection methods
Lists every way a system connects to Pensieve, through the bridge, directly from the platform or through a provider adapter, with protocol and direction.
A hospital system, partner or provider connects to Pensieve by one of three families of method: through orophin, the bridge, direct from the platform, or through a provider adapter. This page lists the methods in each family with protocol, direction, counterpart and where each is configured, usually in Westron, then sets out how to choose.
Through the bridge
A system on the hospital network connects through the bridge, which runs on a host on that network and dials out to the platform. The methods below share its one outbound link, described in the bridge. A large file from a watched folder is the exception and goes to platform storage by a signed upload.
| Method | Protocol | Direction | Typical counterpart | Configured in |
|---|---|---|---|---|
| HL7 v2 messages | HL7 v2 in ER7 encoding over MLLP, on port 2575 by default | Into Pensieve, with the verdict on the sender's open connection | An HIS, LIS or RIS sending results, ADT or orders | Westron, with the listener set on the bridge |
| FHIR push | FHIR R4, version 4.0.1, as JSON resources and bundles | Into Pensieve, answered with an OperationOutcome | An EHR or departmental system that speaks FHIR | Westron, as a bridge-hosted connection |
| Analyser feed | ASTM E1381 for the link and ASTM E1394 for the records, over TCP on port 2576 by default | Into Pensieve | A laboratory analyser with no LIS in front of it | Westron, with the listener set on the bridge |
| Watched folder | Delimited rows in files written to a folder on the hospital network | Into Pensieve | A system that exports files, such as a pharmacy or stock system | Westron, with the folder set on the bridge |
| Order out | An HL7 v2 order message, ORM^O01 or OML^O21, handed to the bridge as a command | Out of Pensieve, with the system's acknowledgement returned | The laboratory or departmental system that fulfils the order | Westron, through the connection's outbound mapping |
| Worklist entry | A scheduled imaging order, handed to the bridge as a command for the modality worklist | Out of Pensieve | The modalities that read the worklist | Westron, on the imaging connection |
The HL7 v2 message types are listed in HL7 v2, the FHIR resources in FHIR and folder handling in file drops. The feeds of an incumbent system and of a laboratory are traced in hospital information systems and laboratories and analysers.
Direct from the platform
A partner service on the internet is called by the platform itself, with credentials the hospital holds for that service. A direct connection is such a link, made over HTTPS through the governed outbound path.
| Method | Protocol | Direction | Typical counterpart | Configured in |
|---|---|---|---|---|
| Partner FHIR server | FHIR R4 transaction bundles over HTTPS for orders and for patient and encounter updates, authorised by SMART Backend Services | Out of Pensieve, with the response returned | The FHIR server of a system of record, or another FHIR server the platform can reach | Westron, as a direct connection |
| Claims | FHIR R4 bundles for coverage eligibility, pre-authorisation and the claim, signed (JWS) and encrypted (JWE) | Out of Pensieve, with responses and settlement advice read back | Insurers, TPAs and schemes on the National Health Claims Exchange | Westron, switched on with a second person's approval |
| National digital health | FHIR R4 bundles to the NRCeS profiles, shared with the patient's consent and encrypted end to end | Out of Pensieve, with responses returned | ABDM and its consent manager | Westron, under the hospital's own ABDM registration |
| Insurer or TPA endpoint | FHIR R4 over HTTPS to the endpoint registered on the connection, with the credential type set there | Out of Pensieve, with the response returned | An insurer or TPA outside the claims exchange | Westron, as a direct connection |
How each of these exchanges runs is described in outbound exchanges, insurers and claims and national digital health.
Provider adapters and other paths
A provider adapter is a dedicated link from the platform to one provider's service, set apart from the governed outbound path. Each adapter that calls a provider account presents the hospital's credential, read from the secret store. A callback is read only after the provider's signature is verified, as the integration architecture describes.
Vault takes online payments through the gateway's adapter, Raven sends through the messaging providers' adapters, and staff sign-in reaches the hospital's identity provider through an adapter of its own. Bulk loads arrive through Nexus Manager, Westron and Vault.
| Method | Protocol | Direction | Typical counterpart | Configured in |
|---|---|---|---|---|
| Payment gateway | The gateway's interface, with each notification signed by HMAC-SHA256 over its raw body | Out to create the payment order, with the notification returned | Razorpay, on the hospital's own merchant account | Westron, switched on with a second person's approval |
| Messaging providers | Each provider's interface, with signed delivery receipts | Out of Pensieve, with receipts returned and replies on WhatsApp | MSG91, the WhatsApp Business Platform, Amazon SES, Firebase Cloud Messaging and Exotel | Raven, channel by channel, with SMS, WhatsApp, email and voice credentials held by reference |
| Identity provider | SAML 2.0, service-provider initiated, or OpenID Connect with PKCE | Into Pensieve, as a person's sign-in | The hospital's own identity provider | Set up for the organisation |
| Imaging | DICOMweb over HTTPS on port 443: STOW-RS to store, QIDO-RS to find, WADO-RS to retrieve | From the imaging source to the Pensieve imaging store | The hospital's PACS or RIS-PACS | Westron, on an imaging connection that carries the study reference |
| Bulk loads | Filled templates and CSV manifests of up to 50,000 rows, and remittance advice in FHIR R4 | Into Pensieve | The hospital's own data files, and the remittances payers send | Nexus Manager, Westron and Vault |
The imaging path is described in imaging, the providers in payments and messaging providers, staff sign-in in single sign-on, and the loads in bulk loads.
Choosing a method
The standard the source system already speaks decides the method. Every inbound method through the bridge ends in the same receipt transaction on the platform, so the choice changes only the wire.
Results and ADT from an incumbent system go over HL7 v2, where the sender holds its connection open and reads the application verdict. A system of record that keeps patient and visit details hears of changes made in Pensieve only through its FHIR server, over a direct connection, and a partner FHIR server takes orders the same way. A system that can only write files uses a watched folder.
An analyser connects to the bridge over ASTM where it has no LIS between it and Pensieve. Where an LIS already stands in front of the analyser, the LIS sends each result over HL7 v2.
Systems join as connections
A system joins Pensieve as a registered connection with its own identity, purpose of use and audit. By design, the people-facing interfaces carry no general-purpose API keys, service accounts or OAuth client applications.
People work through two governed interfaces: named actions for every write and object sets for every read. Each call is decided and audited within the transaction that carries it out, and every session on those interfaces belongs to a person.
Common confusions
Which route does a claims bundle take?
Claims go from the platform to the National Health Claims Exchange over a direct connection, signed with the hospital's own key and encrypted for the party each bundle is addressed to.
Is a FHIR system a bridge-hosted connection or a direct one?
A FHIR system on the hospital network pushes to Pensieve through the bridge, as a bridge-hosted connection. A FHIR server the platform can reach takes orders and patient pushes over a direct connection.
Does a large file map like a small one?
It does. Once the bridge has uploaded the file to platform storage, its rows map through the connection's field mapping as a smaller file's would.
Read what a connection holds in anatomy of a connection, and how each side proves who it is in authentication between systems.