For hospital IT and security reviewers

IT Architecture & Security Brief

Answers to common vendor risk assessment questions. Share this page or its PDF with your security team before a pilot.

Data flow

Echo machine / PACS
   │  DICOM send (internal network only)
   ▼
On-site connector  ── strips identifiers, renders frames locally
   │  outbound HTTPS (TLS) only, per-workspace key
   ▼
EchoReview workspace ── private storage, audit trail
   │
   ▼
Cardiologist review & sign-off ──► staff confirm report placed in chart

Vendor risk assessment answers

Does the connector open inbound ports to the internet?: No. The connector only makes outbound HTTPS (TLS) requests to EchoReview. Inside the hospital it listens for DICOM sends from your PACS or echo machine on a port your IT team chooses on the internal network. No inbound internet firewall rule is needed.
Is metadata stripped before anything leaves the network?: Yes, by design. The connector converts each study into image frames locally and sends only those frames plus a short metadata record: your internal case number, optional age and sex, view, and frame rate. The original DICOM file, patient name, MRN, and date of birth are never sent. Text burned into image pixels is not removed automatically and must be checked during site testing.
How is the connector authenticated?: Each workspace receives its own connector key. EchoReview stores only a SHA-256 hash of the key, records when it was last used, logs every delivery attempt, and lets an administrator revoke the key immediately.
Who can see studies once they arrive?: Only approved members of that hospital's workspace. Images are kept in private storage and delivered through short-lived signed links. Review, sign-off, addendums, and chart-return confirmations are recorded in an audit trail.
Does any AI receive our studies?: No. Routine uploads, connector deliveries, and reporting do not send images to any AI service. AI is in development and research-only.
What has not been validated yet?: The connector has not been validated inside a hospital network. A pilot should include joint testing of image fidelity, frame order, failed deliveries and retries, firewall configuration, and recovery. Independent penetration testing, SOC 2, and HIPAA attestations have not been completed; we do not claim them.

Case-number mapping: your staff keep the patient link

EchoReview never needs a patient's name or MRN to keep studies organized. Each study carries only an internal case number that your hospital already uses.

Use an identifier from your own system, such as the echo accession number, that maps to the patient in your master patient index (MPI) or EHR.
Keep the mapping inside your network, in the EHR order or an access-controlled log. Never put names, MRNs, or birth dates in the case number, file name, or notes.
At upload, confirm the case number matches the patient on the order.
At chart return, look up the case number in your system, place the signed report in that patient's chart, then confirm placement in EchoReview.
If a case number is wrong, correct it on your side and notify the reviewer; EchoReview cannot detect a mismatch because it never sees patient identity.

Report return: today and Phase 2

Today: manual copy into the chart followed by a recorded staff confirmation covering the exact signed report and addendums.

Phase 2 (planned, not yet built): structured text matching standard echo report templates, HL7 v2 ORU messages, and FHIR R4 DiagnosticReport exports through your interface engine, each tested with your IT team before use.