How Pensieve integrates

Pensieve connects to the systems a hospital already runs through an on-site bridge, and to national, payer and provider services from the platform itself. This page sets out the principles every integration follows and the mechanism behind each one.

Existing systems stay in service

A hospital can keep its laboratory system, registration system and analysers for as long as it chooses. Each connects to Pensieve in the protocol it speaks, through orophin, the bridge the hospital installs on its network. The imaging source sends its studies to the Pensieve imaging store over DICOMweb, on a path apart from the bridge.

Pensieve can run beside an incumbent system that keeps some domains, run as the whole platform, or take domains over from the incumbent one at a time. Each shape, and what the hospital provides for it, is described in integration models.

The bridge dials out, the platform decides

From a host inside the hospital, the bridge starts one long-lived link to the platform itself, mutually authenticated on port 443, and traffic in both directions then shares it. No port is opened to the internet, and the bridge's listeners take traffic from the hospital network only, as networks and trust zones shows leg by leg.

The bridge finds where each message starts and ends, seals it into an encrypted queue and moves the bytes. Terminology, mapping, the access decision and the write to the record all run on the platform, where they are governed and audited, as the trust boundary explains.

Every crossing is decided and recorded

An inbound message is checked against its bridge's right to deliver into its site, inside the transaction that stores it, so a message commits only while that right holds. Beside the stored message, the crossing leaves two records free of clinical content. The boundary record holds its direction, its purpose of use and a hash of its content, and the integrity record proves the exact bytes received.

An outbound exchange writes its boundary record when its response returns. A single trace identifier travels with each exchange across the bridge, the platform and the reply, so an operator can follow it end to end.

Requests from people and connected systems enter through a single path that establishes the caller and decides the action, as one door in and one door out explains.

Data moves in both directions

Inbound, a laboratory result reaches its order in Forge and an admission reaches Gate as typed facts, each acted on by the tool that owns the next step. The governed outbound path carries the other direction: orders to a laboratory, patient and encounter changes to the system of record, and claims and eligibility checks to a payer. That path queues each send durably, keys it so every retry of one send carries the same key, and records the response, as outbound exchanges sets out.

Payments, staff sign-in and messages to patients and staff use dedicated adapters for the payment gateway, the hospital's identity provider and the messaging providers. A provider's callback is acted on only after its signature is verified.

Open standards on the wire

Pensieve exchanges data in the standards hospital systems use: HL7 v2 over MLLP, FHIR R4, ASTM E1381 and E1394 for analysers, and DICOMweb for imaging. SNOMED CT, LOINC, ICD-11 and UCUM carry clinical meaning across them, and the page on open standards lists where each one is used.

Every inbound message is kept as the bytes its sender wrote. The hospital takes its data out whenever it chooses, in standard formats, through the self-service export described in export and exit.

The hospital's own registrations and accounts

The hospital takes part in the Ayushman Bharat Digital Mission and the National Health Claims Exchange under its own registration. It takes online payments on its own merchant account, Raven sends through the messaging provider accounts configured for the hospital, and Pensieve carries each exchange on the hospital's behalf.

Each credential is held by reference in the platform's secret store and read only at the moment of the call. The custody rules, including the second approval that switches on the claims and payment rails, are set out in authentication between systems.

Common confusions

Read how each path is built in the integration architecture, and how controls hold on every crossing in governance of integrated data.