Cutsheet Monitoring Xper.pdf

4522 170 56281 CSIP Level 0 Page 1 of 46

IT Specification Guide

Xper Information Management System 6.1

Healthcare, Cardiology Informatics

D001433166;C.2;Released;IT Specification Guide;460

4522 170 56281 CSIP Level 0 Page 2 of 46

Contents

1 INTRODUCTION

1.1 Document History

1.2 Purpose

1.3 Customer Responsibilities

1.4 Abbreviations

1.5 Conventions

2 SYSTEM OVERVIEW

2.1 Overview

2.2 Compatibility

2.2.1 Interface Servers

2.2.2 Product Compatibility

2.2.3 Third Party Software

3 DEPLOYMENT MODELS

3.1 Conformance with Hardware Management Solutions

3.2 Virtual infrastructure environment

3.2.1 Virtualization Settings

4 HARDWARE SPECIFICATION

4.1 Overview

4.2 Hardware Requirements

4.3 Virtual Application and VDI

4.4 What Devices can be Facility Provided

4.5 Hardware Specifications (Physical Hardware)

4.5.1 Xper IM DataCenter Server Configuration Types

4.5.2 Xper IM DataCenter Server (Physical Hardware)

4.5.3 Client Workstation

4.5.4 Patient Status Viewer Monitor

4.5.5 Test Environment Functions

4.6 Hardware Specifications (Virtual Environment)

4.6.1 Server Specification - Virtual Environment Requirements

4.6.2 Production SQL and Xper IM DataCenter Server (shared server)

4.6.3 Production SQL Server (split server)

4.6.4 Production Xper IM DataCenter Server (split server)

4.6.5 Test Environment Functions

4.6.6 Test Environment Specifications

5 SOFTWARE SPECIFICATIONS

5.1 Overview

5.2 Supporting non-English systems

5.3 Platform Requirements

5.3.1 Servers

5.3.2 Workstations (Clients)

5.4 Anti-Virus Software

5.5 PRS Connection

4522 170 56281 CSIP Level 0 Page 3 of 46

6 SERVICE PACKS AND UPDATES

6.1 Overview

6.2 Xper IM Software Updates

6.3 Microsoft Security Updates

6.4 Microsoft Service Packs and Hotfixes

6.5 Anti-Virus Configuration

6.5.1 Anti-Virus Settings

6.5.2 Anti-virus Guidelines and Other Recommendations

6.5.3 Windows Defender

6.6 Anti-virus Exclusions

6.6.1 DataCenter Server

6.6.2 Client Workstation

7 BACKUP AND RESTORE

7.1 Xper IM Server Files

7.2 Xper IM Database Backup

7.3 Virtual Environment Snapshot

7.4 Disaster Recovery

7.4.1 Virtual Server Recovery

7.5 System Boot Sequence

7.5.1 Xper IM DataCenter and SQL Instance on Shared Server

7.5.2 Xper IM DataCenter and SQL Instance on Separate Servers

7.6 Services Used by Xper IM

7.6.1 Xper IM DataCenter Server

8 NETWORK SAFETY, SECURITY AND PRIVACY

8.1 Philips Product Security and Privacy

8.1.1 Customer Role in the Product Security Partnership

8.1.2 Audit Trails

8.1.3 Operational Security

8.1.4 Physical Security and Limited Access to Systems

8.1.5 Strong Password Policies

8.1.6 Protecting Personal Information

8.1.7 Protecting Personal Health Information

8.1.8 About HIPAA Rules

8.1.9 About the EU Directives

8.2 Networking

8.2.1 TCP/IP Communication

8.2.2 Secure FTP

8.2.3 IPSec for DICOM Modality Worklist SCU

8.2.4 Network Switch Setting

8.2.5 Netfail Sensitivity

8.2.6 Virtual Local Area Networks (VLANs)

8.2.7 Wireless Networks

8.2.8 Network Addressing

8.2.9 Network Port Usage

8.2.10 Vulnerability Scanning

8.2.11 Network Diagram

8.2.12 Ports and Protocols Diagram

8.2.13 Confidential Information Sharing (PII/ePHI) Diagram

8.3 Windows Firewall

8.4 Internet Access

4522 170 56281 CSIP Level 0 Page 4 of 46

8.5 Remote Connectivity

8.6 Windows Security

8.7 Group Policy and Permissions

8.8 Encryption - Data at Rest

8.8.1 Xper IM Client

8.8.2 Xper IM Datacenter SQL TDE

8.9 Encryption for Microsoft SQL Server – Data in Transit

8.10 SQL Security Recommendations

8.11 Software Authentication

8.11.1 Xper IM User Accounts

8.11.2 Single Sign-On

8.11.3 Password Policy

8.11.4 LDAP/LDAPS Usage

9 SPLIT PC CONFIGURATION

9.1 Introduction

9.1.1 Rationale

9.1.2 Split PC Solution

9.1.3 Hardware Requirements

9.1.4 Responsibilities

9.2 Split PC Configurations

9.2.1 Control Room Configuration

9.2.2 Procedure Room Configuration

4522 170 56281 CSIP Level 0 Page 5 of 46

1 INTRODUCTION

1.1 Document History

Reason for Changes Date of Publication

First Issue 2025-JAN-08

1.2 Purpose

This guide was created primarily to aid IT specialists in Xper IM system implementation. This guide can be referred to prior to the Xper IM installation.

1.3 Customer Responsibilities

In case the customer provides the infrastructure to host Xper IM, the following responsibilities apply:

• Providing the hardware or virtual environment to run the Xper IM software, compliant with the specifications documented in the chapters that follow.

• Installing and configuring the hardware, software, and infrastructure, which hosts the Xper IM software. Securing the system with installing and maintaining recommended AV solutions, regular updates of the OS, physical and operational security of the system.

• Providing, configuring and supporting any additional third-party software not specified as part of the Xper IM product. This includes backup, any remote access, or any report generation software.

• Users may configure remote access utilities to require local user authorization prior to establishing a remote connection.

• It is customer's responsibility to ensure compliance with market-specific legislative or customer requirements regarding system data sanitization procedures. The customer, as the owner of the hardware, is responsible to use media that supports hardware sanitation commands.

• The system stores personal data on off the shelf hardware components that can be removed at system decommissioning or resale.

• Windows User login auditing (success and failure) is done on OS level. This is enabled by default in Windows and is available for audit purposes.

1.4 Abbreviations

The list below includes all abbreviations and terms found within this guide. A description of each term is also provided.

Abbreviation/Term Description

AV Anti-Virus

CWIS Cathlab Workstation Integration Service with Allura

DICOM Digital Imaging and Communications in Medicine (protocol)

FTP File Transfer Protocol

FTPS

FTPS (also known as FTPES, FTP-SSL, S-FTP and FTP Secure) is an extension to the commonly used File Transfer Protocol (FTP) that adds support for the Transport Layer

Security (TLS) and the Secure Sockets Layer (SSL) cryptographic protocols. HIS Hospital Information System

HTTP Hyper Text Transfer Protocol

HTTPS Secure Hyper Text Transfer Protocol

IBE IntelliBridge Enterprise

IP Internet protocol

IPsec Internet Protocol Security

4522 170 56281 CSIP Level 0 Page 6 of 46

ISCV IntelliSpace Cardiovascular

IT Information Technology

LDAP Lightweight Directory Access Protocol

LDAPS Lightweight Directory Access Protocol over SSL

MS Microsoft

NET Network

NETBIOS Network Basic Input/Output System

OS Operating System

PHI Protected Health Information

PII Personally Identifiable Information

PRS Philips Remote Support

RDP Remote Desktop Protocol

RPC Remote Procedure Call

SCU (DICOM) Storage Class User

SMB Server Message Block

SQL Structured Query Language

SSL Secure Socket Layer

TDE Transparent Data Encryption

TCP Transmission Control Protocol

TCP/IP Transmission Control Protocol/Internet Protocol

TLS Transport Layer Security

UDP User Datagram Protocol

VDI Virtual desktop infrastructure

VLAN Virtual Local Area Network

VNC Virtual Network Computing

Xper IM Xper Information Management System

1.5 Conventions

The banner below will be seen in this manual.

NOTE

NOTE messages provide additional user information or calls attention to a certain topic.

4522 170 56281 CSIP Level 0 Page 7 of 46

2 SYSTEM OVERVIEW

2.1 Overview

Xper IM offers a highly configurable cardiovascular workflow solution for the Cath Lab. This innovative software suite presents a variety of innovations for reporting, scheduling, inventory and intelligent data management. With tools that enhance efficiency on multiple levels, the solution improves and simplifies workflow for cardiology professionals.

Xper IM can send information to or receive information from other hospital information systems by the IntelliBridge Enterprise (IBE) interface broker.

Figure 1 Xper IM basic overview

• Xper IM client: A workstation with Xper IM software installed which communicates with the Xper IM DataCenter server. The client contains a local SQL database which is synchronized with the SQL database on the Xper IM DataCenter server. Licensing and global configuration is received from the Xper IM DataCenter server.

• Xper IM DataCenter server: This is the central server that stores all data from Xper IM Clients.

SQL is used for the Xper IM databases.

• IBE server: ODBC connections to the Xper IM DataCenter SQL databases are established to parse data to and from external systems via HL7, DICOM or file-post

• Modalities: DICOM capable systems which request DICOM Modality Worklist and MPPS data from IBE or send their MPPS data to Xper IM.

Xper IM client

Modalities

SQL

Interfacing Configuration

Flat Files

Licenses

Global Configuration

SQL

ODBC

Flat Files

4522 170 56281 CSIP Level 0 Page 8 of 46

2.2 Compatibility

The software product described in this guide should not be used in combination with other software, equipment or components unless such other software, equipment or components are expressly recognized as compatible by Philips Healthcare. A list of such software, equipment and components is available on request from your local Philips Healthcare Representative, or the Manufacturer. Philips Healthcare is not responsible for running compatibility validation of non-supported third-party software.

Changes and/or additions to the software product should only be carried out by Philips Healthcare or by third parties expressly authorized by Philips Healthcare to do so. Such changes and/or additions must comply with all applicable laws and regulations, which have the force of law within the jurisdictions concerned, and with best engineering practice.

All configurations within this guide have been tested and approved by Philips. Philips has found that the Xper IM system performance is fit for normal use when the given specifications have been met. Deviation from specifications contained herein may affect performance.

Changes and/or additions to the software product that are carried out by persons without the appropriate training may lead to the Philips Healthcare warranty being voided.

Philips is not responsible for any malfunction of Xper Information Management System if Xper Information Management System runs on hardware that is not according to hardware specification.

If not supplied by Philips with the Xper Information Management System software, Philips is not responsible for any malfunction of the hardware used.

2.2.1 Interface Servers

Compatible with Xper IM 6.x

Comment

IntelliBridge Enterprise ✓ Replaced Xper Connect

Note:

• Xper IM DataCenter and IBE may share the same SQL Database Instance as long as SQL Server resources are sufficient to accommodate this.

2.2.2 Product Compatibility

Product compatibility with other Philips products, and their specific versions, can be found in the Xper IM 6.X Compatibility Matrix.

2.2.3 Third Party Software

These items are third party software products used in the development of the Xper Information Management Product.

SL

No

Name of the third party item

Version # and Manufacturer name

Usage Description

1 Billenium Effects 4.1 - IRDevelopers Library with graphical effects for user interfaces.

2 Kbm Memtable 6.1 -

Components4Developers KbmMemtable is used to store data temporarily in your Delphi Win32/Win64/MacOS/Android/IOS, C++ Builder or FPC application, and you at the same time wanted full access to the data as if they were stored in a database table, you have the right solution here. kbmMemTable is a full TDataset compatible in memory table loaded with functionality.

3 madExcept 3.0K - Madshi madExcept was built to help you locate bugs in your software.

madExcept is also able to find memory leaks, resource leaks and buffer overruns for you.

4 Addict4 4 - Addict Addict is a component suite providing end-to-end solutions for adding spelling check and thesaurus support to your Delphi

4522 170 56281 CSIP Level 0 Page 9 of 46 and C++Builder applications. Addictive software component design software.

5 Addict4plus40pack 4 - Addict Addict is a component suite providing end-to-end solutions for adding spelling check and thesaurus support to your Delphi and C++Builder applications. Addictive software component design software.

6 TMS Pack 1.7.1.3 - TMS Software TMS Component Pack - Create modern-looking & feature-rich Windows applications faster with well over 375 components in one money and time saving bundle for Delphi.

7 Eldos SecureBlackBox

7 - Eldos Corporation SecureBlackbox is a suite of software components that allows developers to add strong security to their applications to protect binary data, files, documents and e-mails.

8 NativeXML 2 - Sim Design B.V. This software component contains a small-footprint Object Pascal (Delphi) XML implementation that allows to read and write XML documents. You basically only need one unit and you can simply add it to the "uses" clause.

9 NativeXMLUtf8 4.02 - Sim Design B.V.

This software component contains a small-footprint Object Pascal (Delphi) XML implementation that allows to read and write XML documents. You basically only need one unit and you can simply add it to the "uses" clause.

10 TxQuery 1.86.2 - Alfonso Moreno TxQuery component is a TDataSet descendant component that can be used to query one or more TDataSet descendant components using SQL statements.

11 ImageEn 3.0.2 - Hi Components ImageEn is an extensive component suite for image editing, display and analysis written in pure VCL code for Delphi and C++ Builder, and is also available for .NET.

12 Jedi component library

3.35 - The Jedi Project JEDI VCL for Delphi - JVCL is a library of more than 600 visual and non-visual components for Delphi 5, 6, 7, 2005, 2006, 2007 and 2009; C++Builder 5, 6, 2006, 2007 and 2009.

13 Softgems VirtualTree View

4.7.0 - Soft Gems Virtual Treeview is a treeview control built from ground up.

More than a decade of development made it one of the most flexible and advanced Delphi tree controls available today.

14 Active Query Builder 6.5.1 - Si Components Active Query Builder is a Visual SQL Query Building component that allows your end-users to build complex SQL queries via an intuitive interface.

15 RemObjects AnyDAC

2.0.9 - AnyDac AnyDAC is a set of components for CodeGear Delphi and the open source Free Pascal Compiler that provide high-speed native data access to a variety of back-end database engines.

16 TsiLang 6.5.1 - Si Components TsiLang is a software localization components suite for Delphi and C++Builder developers. This suite supports all languages and can do both internal (inside executable file) and external (separate file or library) localization.

17 SMImport 2.67 - Scalabium SMImport suite allow to load the data from: -Excel, Lotus 1-2-3, QuattroPro spreadsheets -MS Excel, MS Word, MS Access (DAO/MS Jet) -Text (fixed or CSV) -HTML, XML - Paradox/DBase files - ADO connections.

18 ReportBuilder 11.04 - Digital Metaphors Corp

Build complete report server solutions for publishing reports to remote client applications and web browsers. Publish reports as XHTML to web browser clients. Build ISAPI, ASP, Apache web applications.

19 TeeChart Pro 8.04 - Steema Software TeeChart Pro provides complete, quick and easy to use charting .NET, Java, ActiveX / COM, PHP and Delphi VCL / FireMonkey controls for business, Real-time, Financial, Scientific and Mobile applications.

20 wPDF comps 6.3.1 - wPDF comps wPDF, is a powerful PDF maker which has been available since July 2001, has been specially optimized for greater compatibility with most drawing commands commonly found in Windows applications.

21 Database Comparer 3.2 - clevercomponents Database Comparer is an easy to use utility to compare your databases. With this tool you can synchronize your databases

4522 170 56281 CSIP Level 0 Page 10 of 46 also and in one of its features it provides option to update your databases structure.

22 DevExpress VCL 4.46 - DeveloperExpress Visual Component Library for building user interfaces in Delphi.

23 TOnGuard 1.13 - TurboPower OnGuard is a library to create demo versions of your Borland Delphi & C++Builder applications. Create demo versions that are time-limited, feature-limited, limited to a certain number of uses, or limited to a certain # of concurrent network users.

24 Hydra 3- RemObjects This component is usually dropped on the main form or main data module of your host executable and contains a variety of methods to facilitate the loading of DLLs and the creation of plugins.

25 FastMM4 4.92 - RemObjects FastMM is a lightning fast replacement memory manager for Embarcadero Delphi Win32 and Win64 applications that is not prone to memory fragmentation, and supports shared memory without the use of external .DLL files.

26 Wittlog 2.2 - Philips (Internal) - Legacy component

Proprietary log component

27 GDIP_pas 15-FEV-2002 Library framework for Delphi Applications

29 DelphiTwain 1.9 - Gustavo Huffenbacher Daud

Twain provides a common interface to access such devices as scanners, webcams, some fax modems, database engines, digital cameras.

30 Regular Expressions

2009 - Erik van Bilsen

This library emulates the .Net classes in the System.Text.RegularExpressions namespace.

31 OpenSSL 1.0.2.L - OpenSSL Management Committee

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a general-purpose cryptography library.

32 SynPDF 1.18 - LiveMoon Synopse PDF engine is an Open Source PDF document creation library for Delphi, embedded in one unit.

33 Indy 10.6.3.3 - Indy Project Connectivity and Security. It affects all TPC, FTP and SQL connections.

34 Microsoft Windows Operating System

Win10 on Xper client.

WS2012 SP3,

WS2016, WS2019 on Datacenter (Xper server)

Microsoft Corporation

Operating system

35 Microsoft .NET Framework

3.5 and 4.0

Microsoft Corporation

Base framework

36 Microsoft SQL Server

2012 and 2014 SP2 (on WS2012R2) 2016 SP1, 2017 and 2019 (on WS2016 and WS2019) Microsoft Corporation

Database server

37 Microsoft SQL Server Native Client

10 Database connection driver

38 TVideoGrabber

SDK

v15.1.1.8 Datastead

TVideoGrabber SDK is designed to implement audio/video capture and playback into applications developed

4522 170 56281 CSIP Level 0 Page 11 of 46

3 DEPLOYMENT MODELS

Xper IM Datacenter can be deployed on a virtual environment or on a stand-alone physical server. If deployed on a virtual environment, the configuration must fulfill the hardware requirements regarding system performance and system features as specified in the Recommended Specifications in section 4.

3.1 Conformance with Hardware Management Solutions

Xper IM has been designed to work with Microsoft-supported hardware management solutions.

3.2 Virtual infrastructure environment

Xper IM is supported when running on generally available server virtualization platforms. Refer to the compatibility information of the virtualization platform to verify that the Xper IM platform (OS+SQL) is supported on the virtualization platform.

The VMWare environment should be running on compatible, VMWare approved hardware.

For more information about compatibility, refer to the VMWare website at:

https://www.vmware.com/resources/compatibility/search.php

3.2.1 Virtualization Settings

Philips Healthcare may request that the facility take a “snapshot” of an environment prior to a specific maintained event or upgrade; but it is not recommended to actively keep more than one snapshot of a system while in use as this is known to cause drive performance issues. Refer to Virtual Environment Snapshot in this document for further details regarding VM snapshots and connectivity considerations.

VMWare tools should always be up to date and running to ensure that the virtual network card is operating at peak performance.

VMWare tools should always be up to date and running to ensure that the virtual network card is operating at peak performance.

Xper Information Management Datacenter will require reboot or restart of the Datacenter Service following the use of the VMware vSphere vMotion utility.

This utility should not be used while Xper Information Management is in use as a persistent state of Net Fail may result until restart of the Server.

4522 170 56281 CSIP Level 0 Page 12 of 46

4 HARDWARE SPECIFICATION

4.1 Overview

This chapter contains Xper IM hardware specifications. Customer provided hardware must meet the specifications documented in this chapter.

4.2 Hardware Requirements

Philips provides minimum specifications for hardware devices. Hardware specifications can be equivalent or better than those listed. Performance has been found acceptable when using the specified hardware.

4.3 Virtual Application and VDI

No virtual application or VDI technologies such as Citrix Xen App or Xen Desktop have been tested or approved for use with Xper IM software.

4.4 What Devices can be Facility Provided

The following devices may be provided by the facility:

• DataCenter server

• Workstation (for use as a review or patient status viewer)

• UPS (Optional)

• Monitor or Video display

• “Patient Status Viewer” monitor

4.5 Hardware Specifications (Physical Hardware)

Xper IM minimum hardware specifications are listed in this chapter.

4.5.1 Xper IM DataCenter Server Configuration Types

The Xper IM DataCenter server can be configured multiple ways with functions split across different devices. The test databases can be co-located on a Production SQL server if it is in a split server configuration. It cannot be co-located on a Production “shared server” with both SQL server and the application present.

4522 170 56281 CSIP Level 0 Page 13 of 46

4.5.2 Xper IM DataCenter Server (Physical Hardware)

Requirements (Minimum Specifications)

CPU Quad Core

RAM 12 GB

Video 1280x1024

Hard Drive 1 TB

Network 1 GB/s

4.5.3 Client Workstation

Requirements (Minimum Specifications)

CPU Dual Core

RAM 4 GB

Video 1920x1080

Hard Drive 500 GB

Network 1 GB/s

4.5.4 Patient Status Viewer Monitor

Any monitor or television that meets the following requirements should function correctly:

• 32” or above

• Resolution 1360 x 768

• DVI or VGA input

Note: HDMI is not recommended.

4.5.5 Test Environment Functions

If the purpose of your test environment is to have an exact replica of the Production environment for performance testing or as a potential server replacement in a disaster recovery strategy, use the production specifications for your build.

The intention of the test environment specifications below is to support the need of a separate environment where testing may be performed outside of your production environment using a small number of stations with little concurrent activity.

4522 170 56281 CSIP Level 0 Page 14 of 46

4.6 Hardware Specifications (Virtual Environment)

Xper IM recommended hardware specifications are listed in the tables below.

4.6.1 Server Specification - Virtual Environment Requirements

Xper IM 6.x is supported to be run on all mainstream hypervisors as long as the hypervisors officially claim compatibility with our OS and SQL version.

The virtual specifications for the Xper IM Servers running on this virtual environment are included in the tables in this section.

4.6.2 Production SQL and Xper IM DataCenter Server (shared server)

Component Specification

Processor 2 x vCPU Xeon Quad Core E5620 2.5 GHz or greater

RAM 12 GB (minimum)

Primary Hard Drives See below drive configuration

Network Card(s) VMXNET3

Drive Configuration

Disk Qty Volume Purpose Storage Tier Size

0 2 C:\ OS - At least 60 GB

1 2 D:\ System Database Min. SATA 5 GB

2 - E:\ TempDB SAS or SDD 5 GB

3 2 F:\ Xper IM DBs SAS or SDD Number of cases x 2.0 Mb per year Monitor and scale as needed.

4 2 G:\ Transaction Logs Min. SATA 0.5 x size of F:\ drive Monitor and scale as needed.

5 2 X:\ Xper IM Flat Files Min. SATA Number of cases x 1.0 Mb per year or 500 GB initially 20 GB required for Datacenter software

6 2 Any Backup Drive Min. SATA (DB size x 7 days)

4522 170 56281 CSIP Level 0 Page 15 of 46

4.6.3 Production SQL Server (split server)

When the system is connected to a high-availability SQL cluster, it does not automatically detect a failover. To resume normal operation after a failover event, you must manually restart the Datacenter to reestablish the connection with the database cluster.

Processor 2 x vCPU Xeon Quad Core E5620 2.5 GHz or greater

RAM 12 GB (minimum)

Primary Hard Drives See below drive configuration

Network Card(s) VMXNET3

Drive Configuration

Disk Qty Volume Purpose Storage Tier Size

0 2 C:\ OS - At least 60 GB

1 2 D:\ System Database Min. SATA 5 GB

2 - E:\ TempDB SAS or SDD 5 GB

3 2 F:\ Xper IM DBs SAS or SDD Number of cases x 2.0 Mb per year Monitor and scale as needed.

4 2 G:\ Transaction Logs Min. SATA 0.5 x size of F:\drive Monitor and scale as needed.

6 2 Any Backup Drive Min. SATA (DB size x 7 days)

4.6.4 Production Xper IM DataCenter Server (split server)

Processor 2 x vCPU Xeon Quad Core E5620 2.5 GHz or greater

RAM 6 GB (minimum)

Primary Hard Drives See below drive configuration

Network Card(s) VMXNET3

Drive Configuration

Disk Qty Volume Purpose Storage Tier Size

0 2 C:\ OS - At least 60 GB

5 2 X:\ Xper IM Flat Files

Min. SATA Number of cases x 1.0 Mb per year or 500 GB initially 20 GB required for Datacenter software

4522 170 56281 CSIP Level 0 Page 16 of 46

4.6.5 Test Environment Functions

If the purpose of your Test environment is to have an exact replica of the Production environment for performance testing or as a potential server replacement in a disaster recovery strategy, use the production specifications for your build.

The intention of the test environment specifications below is to support the need of a separate environment where testing may be performed outside of your production environment using a small number of stations with little concurrent activity.

4.6.6 Test Environment Specifications

The Test environment Physical Hardware and/or Virtualization should mirror the Production environment to ensure performance is suitably emulated.

4522 170 56281 CSIP Level 0 Page 17 of 46

5 SOFTWARE SPECIFICATIONS

5.1 Overview

This chapter contains all Xper IM software specifications.

5.2 Supporting non-English systems

The Xper IM server(s) require an English Microsoft OS and Microsoft SQL Server.

The Xper IM Workstations can be installed on English OS (with or without Language Packs) or localized OS.

5.3 Platform Requirements

5.3.1 Servers

Notes:

1 Xper IM has been validated on Standard and Enterprise editions of the SQL Server versions in the above table 2 SQL Server Express Edition is not for use on Server side in a production environment.

Software Requirements

Xper IM 6.1

OS

Windows Server 2016 (x64) Windows Server 2019 (x64) Windows Server 2022 (x64) Security Updates

Microsoft SQL 1

SQL Server 20142 SQL Server 2016 (require x64 OS)2 SQL Server 2017 (require x64 OS)2 SQL Server 2019 (require x64 OS)2

SQL Server 2022 (require x64 OS)2

Microsoft .NET Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.x

Remote Access Software

RealVNC Server Tight VNC VNC Viewer Plus PuTTY FileZilla

4522 170 56281 CSIP Level 0 Page 18 of 46

5.3.2 Workstations (Clients)

Notes:

3 Xper IM software is compatible with all editions of Windows 10 (either x86 or x64 architectures), except IoT Core and IoT Mobile.

To ensure compatibility with all these editions it's required to test one edition of Windows 10, which is suggested the most common one: Windows 10 Pro. That's feasible by virtue of all these editions inherit from the same kernel and code base, where the differences are around of operational system management, deployment and security, which in turn does not affect the features provided by Xper IM software.

4XperIM software is compatible with all editions of Windows 11 (either x86 or x64 architectures), except IoT Core and

IoT Mobile. The recommended versions are Windows 11 Pro. To ensure compatibility with all these editions it's required to test one edition of Windows 11, which is suggested the most common one: Windows 11 Pro. That's feasible by all these editions inherit from the same kernel and codebase, where the differences are around of operational system management, deployment and security, which in turn does not affect the features provided by XperIM software.

5.4 Anti-Virus Software

Xper IM is designed and tested to allow operation with any mainstream enterprise virus-scanning solution which is supported by the vendor on the Xper IM OS/SQL Platform. Philips highly recommends installing anti-virus software. Anti-virus software should only be installed by IT professionals, according to the vendor installation instructions. Any virus-scanner which is supported on the Xper IM platform (Refer to the anti-virus vendor documentation for compatibility information) is supported with Xper IM as long as it is configured according to section 0 Anti-Virus Configuration.

5.5 PRS Connection

Philips provides support through a Philips Remote Support network (PRS) connection. This connection allows remote monitoring, troubleshooting and application support.

Refer to section 8.5 for further details

Software Requirements

Xper IM 6.1

OS

Windows 10 3

Windows 114 Security Updates

Microsoft SQL

SQL Server 2014 Express SQL Server 2016 Express (require x64 OS) SQL Server 2019 Express (require x64 OS) SQL Server 2022 Express (require x64 OS)

Microsoft .NET Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.x

Remote Access Software

RealVNC Tight VNC VNC Viewer Plus PuTTY FileZilla

4522 170 56281 CSIP Level 0 Page 19 of 46

6 SERVICE PACKS AND UPDATES

6.1 Overview

This chapter instructs you on how to properly address service packs, hotfixes, and updates related to Xper IM server(s) and clients.

6.2 Xper IM Software Updates

Xper IM software is regularly updated and provided to customers in the form of a software revision or a hotfix.

These software updates will be installed on Xper IM server(s) by the local Philips support organization upon request according to the Service Level Agreement.

6.3 Microsoft Security Updates

Philips authorizes customers to install Operating System security patches, including security updates related to SQL.

Xper IM is designed to allow auto-update to be enabled on servers on which the product is installed.

If auto-update is not allowed to be enabled (e.g. per hospital IT policy), customers are strongly advised to apply Operating System Security patches manually, according to the vendor’s instructions.

Official patch validation information is published online at http://philips.com/productsecurity

6.4 Microsoft Service Packs and Hotfixes

We strongly recommend not to install any Microsoft Windows Service Pack or Security Patch unless notified by Philips that it is safe to install.

Do not install any Microsoft Windows Hotfix (non-Security Patches) unless notified by Philips that it is safe to install. Do not accept any Microsoft Windows Hotfix via Automatic Updates that cannot be uninstalled.

You will be warned in advance when you are unable to uninstall a Hotfix.

Customers are allowed to install the latest Microsoft SQL Server Service Packs.

6.5 Anti-Virus Configuration

It is highly recommended that all Xper Information Management systems that reside on hospital networks should have virus protection software installed to further secure the system and have tools available to remove virus infections. Anti-Virus software should be installed and maintained by the Customer according to the guidelines in this chapter to ensure the required exclusions are configured. Customers are strongly advised to apply antivirus updates.

6.5.1 Anti-Virus Settings

Antivirus exclusions are based upon a combination of engineering testing and “real world” experience.

The items listed below may cause issues and should be taken into consideration when configuring and operating an Anti-virus or Endpoint protection system:

• On-Access scanning should be completely disabled

• Be advised the locations on this list may vary due to the configuration of your hardware

• Do not scan the DATACENTER.EXE process

• Do not scan the XIMS.EXE process

• Daily Updates must not be completed during normal work hours.

4522 170 56281 CSIP Level 0 Page 20 of 46

• Weekly full scan during non-operating hours is acceptable.

• Do not allow scanning of network or mapped drives.

• All Heuristic Scanning must be turned off unless the AV documentation states the Exclusions will also be executed for the Heuristic Scanning.

• Any Network or Proactive threat protection features should be disabled.

• Port scanning on Xper IM proprietary ports (90xx and 4000-4100) should be excluded.

6.5.2 Anti-virus Guidelines and Other Recommendations

Heuristics:

Anti-virus heuristics features may cause performance issues within our application. Disable heuristics at your own risk for best performance.

Wildcard usage:

Many anti-virus solutions support the use of wildcard characters to facilitate the process of including multiple files in a file exclusion list. Refer to the anti-virus vendor documentation for details on how to use wildcards properly.

Wildcards will reduce the capabilities of the antivirus software and is not the preferred configuration. It is recommended the specific drive, folder and/or file be excluded.

Threat protection:

Anti-virus Pro-Active Threat Protection & Network Threat Protection features may cause latency issues within our application. Disable Pro-Active Threat Protection & Network Threat Protection at your own risk for best performance.

6.5.3 Windows Defender

If using Windows Defender, the Anti-Virus Exclusions must also be configured.

• In Settings, select Update and Security

• Select Virus and Threat Protection

• Select Exclusions and add the required exclusions according to chapter “Anti-Virus Exclusions”

6.6 Anti-virus Exclusions

The following exclusions are listed by device type.

If using a VMWare server with several drives or if using custom drive letters, exclusions will need to be adjusted appropriately.

6.6.1 DataCenter Server

The following folders and all subfolders/files should be excluded:

• C:\PROGRAM FILES\MICROSOFT SQL SERVER\

• C:\PROGRAM FILES (x86)\MICROSOFT SQL SERVER\ (64 bit OS Only)

4522 170 56281 CSIP Level 0 Page 21 of 46

• C:\XIMS\

• X:\DATACENTER\

• X:\DCCASES\

• X:\MSSQL\

• X:\MSSQLBACKUPS\

The below file/process should be excluded:

• X:\DATACENTER\BIN\DATACENTER.EXE

• C:\XIMS\XIMS.EXE

• C:\iplog.tmp

• C:\SCN.dat

6.6.2 Client Workstation

The following folders and all subfolders/files should be excluded:

• C:\PROGRAM FILES\MICROSOFT SQL SERVER\

• C:\XIMS\

• C:\XIMCASES\ or D:\XIMCASES\ (depending on drive configuration of the Client)

• C:\NextXperFlexCardio

The following files/processes should be excluded:

• C:\XIMS\XIMS.EXE

• C:\iplog.tmp

• C:\SCN.dat

4522 170 56281 CSIP Level 0 Page 22 of 46

7 BACKUP AND RESTORE

This chapter describes the backup and restore of Xper IM server files. The backup of the data is the customer’s responsibility.

7.1 Xper IM Server Files

The list below is a summary of important files that need to be included in the backup job as a minimum, best practice is to use a backup application that will back up the entire system.

On the Xper IM DataCenter server

• Xper IM databases backups located in X:\MSSQL\Backups o XIMS

• Flat file located in X:\DCCASES

• The following configuration files located in X:\DataCenter\Bin:

o datacenter.xml o xims.xml o certificate.cert o license.lic

• Registry (optional)

7.2 Xper IM Database Backup

The Xper IM software automatically installs database maintenance plans which will create regular database backups of the system according to the following schedule:

System Databases

Databases Backup Schedule

Master / Msdb / Model Full Every Day at 12:00 AM

User Databases

Databases Backup Schedule

XIMS Full Every Day at 12:00 AM

XIMS Differential Every Hour

XIMS Transaction Log Every 15 minutes

Database Backups are stored in the X:\MSSQLBACKUPS folder. It is highly recommended to include this folder in the daily backup of the system unless SQL Backups are created externally.

Together with the backup jobs a purge job is also installed which will automatically purge old database backups (older the 14 days) from the system.

For more details related to the setup and/or customization of the maintenance plan contact Philips technical support.

4522 170 56281 CSIP Level 0 Page 23 of 46

7.3 Virtual Environment Snapshot

It is highly recommended that snapshots are taken of the virtual servers to facilitate a method of quickly restoring the system in case of failures.

However, it should be noted that using the Quiesce option will cause the Xper IM DataCenter server to lose connection with Xper IM Clients.

Xper IM Clients will enter a NetFail state and users will be notified within the Xper IM application. The Xper IM Client will continue to operate normally, but data will not be synchronized with the Xper IM DataCenter server until the NetFail state is recovered.

The process of Quiescing brings the file system data into a state suitable for backup and will alter the state of running processes may result in services necessary for Xper IM DataCenter to temporarily pause or stop.

Therefore it is highly recommended that Snapshots utilizing the Quiesce option are taken when the Xper IM Clients are not in use.

7.4 Disaster Recovery

For disaster recovery, an assumption is made that there is no system left and the entire system needs to be rebuilt. All other scenarios will depend on what data is useable and what needs to be recovered to be able to run the application again. Please contact Philips customer support for assistance.

To recover from a complete system failure, the following steps need to be executed to re-install the system:

1. Install new VM/System with OS, SQL and Xper IM according to system manual installation

2. Restore databases from backup folder

3. Restore Xper IM DataCenter flat files folder (default = X:\DCCASES)

4. Restore configuration files (datacenter.xml and xims.xml) to Xper IM DataCenter Application folder

(default = X:\DataCenter\Bin)

5. Request new certificate if necessary – if disk, CPU, NIC, etc. have changed this will result in a new system Machine ID being generated meaning the current certificate will not be valid. Contact the Philips Support Desk for assistance

7.4.1 Virtual Server Recovery

To perform a full recovery best practice is to restore the entire VM, when a backup application like Veeam is used. You can restore the VM from the backup location and migrate to faster storage while the system is live already. This recovery process should normally not take more than approx. 15 to 30 minutes.

7.5 System Boot Sequence

Xper IM DataCenter software is dependent on the availability of the SQL instance, therefore the SQL server and configured instance must be available before the Xper IM DataCenter.

The boot sequence of servers will depend on the solution architecture as described in this section.

7.5.1 Xper IM DataCenter and SQL Instance on Shared Server

In this configuration, the SQL instance utilized by Xper IM DataCenter is installed on the Xper IM DataCenter server.

4522 170 56281 CSIP Level 0 Page 24 of 46

The Xper IM DataCenter server must be started and SQL services available before the DataCenter service (XIM_DATA_CENTER) server are started.

To ensure the SQL service is started and available before Xper IM DataCenter service is started, the startup type for the Xper IM DataCenter service is configured for Automatic (Delayed Start)

7.5.2 Xper IM DataCenter and SQL Instance on Separate Servers

In this configuration, the SQL instance utilized by Xper IM DataCenter is installed on a separate server.

The SQL server must be started and SQL services available before the Xper IM DataCenter server is started.

Boot sequence

1. SQL server

2. Xper IM DataCenter server

7.6 Services Used by Xper IM

Xper IM requires a number of services in order to function.

The following Windows Services must be enabled before starting the XIMS application:

• Application Experience

• COM+ Event System

• Cryptographic Services

• DCOM Server Process Launcher

• DHCP Client

• DNS Client

• Group Policy Client

• Interactive Services Detection

• Network Connections

• Network List Service

• Network Location Awareness

• Network Store Interface Service

• Plug and Play

• Power

• RPC Endpoint Mapper

• Secure Socket Tunneling Protocol Service

• Security Accounts Manager

• Server

• SQL Server

• SQL Server Agent1

• SQL Server Browser2

• Task Scheduler

• User Profile Service

1 The SQL Server Agent service is necessary only when an automatic backup routine is configured to be executed in the client stations (commonly this kind of policy is only applied on the Datacenter station).

2 The SQL Server Browser service is necessary only when the SQL Server instance name is different than “MSSQLSERVER” (SQL Server’s default).

4522 170 56281 CSIP Level 0 Page 25 of 46

• Windows Event Log

• Windows Management Instrumentation

• Windows Driver Foundation - User-mode Driver Framework

• Windows Font Cache Service

Note: This list is based on Windows 10 Operational System, different Operations Systems might not have all the services listed, in these cases they can be skipped.

7.6.1 Xper IM DataCenter Server

Other than the default Services in Windows, Xper Datacenter requires the following:

Services Used for

Application Experience Processes the application compatibility request when the application is launched

COM+ Event System Supports System Event Notification Service.

Network Store Interface Service

This service delivers network notifications to user mode clients. Stopping this service will cause loss of network connectivity.

Windows Event Log This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata.

Windows Module installer

Enables installation, modification, and removal of Windows updates and optional components.

Windows Management Instrumentation

WMI provides a consistent approach to carrying out day-to-day management tasks with programming or scripting languages.

MS SQL Services3 SQL Server Browser, SQL Server Agent and SQL Server services needed for maintenance and Database access

The following service behaviors are implemented on the server during the installation of Xper Information Management:

Service Name Startup State Startup Type Log On

SQL Server Started Automatic Domain Account with local admin permissions

SQL Server Agent Started Automatic Domain Account with local admin permissions

SQL Server Analysis Services Started Automatic NTAuthority\System

SQL Server Integration Services Started Automatic NTAuthority\System

XIM DATA CENTER Started Automatic (Delayed Start)

Local System

3 If the SQL Server is located at Datacenter OS.

4522 170 56281 CSIP Level 0 Page 26 of 46

8 NETWORK SAFETY, SECURITY AND PRIVACY

8.1 Philips Product Security and Privacy

8.1.1 Customer Role in the Product Security Partnership

Philips recognizes that the security of Philips Healthcare products is an important part of your facility's security strategy. However, these benefits can only be realized if you implement a comprehensive, multi layered strategy (including policies, processes, and technologies) to protect information and systems from external and internal threats.

The customer is responsible for setting up and maintaining a secure and stable IT environment according to general IT standards.

Following industry-standard practice, your strategy should address:

• Physical security (e.g., do not allow unauthorized people to use Xper Information Management System)

• Operational security (e.g., make sure that any sensitive information left on the system such as exported files—is removed; make sure that users of Xper Information Management System do not leave the open system unattended)

• Procedural security (e.g., create awareness with regard to the dangers of social engineering; every single user should be given a separate account; do not forget to remove an account when it is no longer needed)

• Risk management

• Security policies (e.g., make sure that the Xper Information Management System Service Documentation and media are securely stored)

• Contingency planning.

The practical implementation of technical security elements varies by site and may employ a number of technologies, including firewalls, virus scanning and anti-spyware software, authentication technologies, network segmentation (VLAN—Virtual Local Area Network), etc.

As with any computer-based system, protection must be provided such that firewalls and/or other security devices are in place between the medical system and any externally accessible systems.

Although the system incorporates state-of-the-art protection mechanisms to protect it against the intrusion of malware (for example, viruses), a remote possibility remains that a system can become infected. System safety remains guaranteed in all circumstances, but the user might notice unfamiliar system behavior and/or performance. If this happens repeatedly, e.g. also after the system has been switched off and on again, the user is advised to contact a Philips Healthcare service representative to have the system checked and, if needed, to remove the malware.

The USA Veterans Administration has developed a widely used Medical Device Isolation Architecture for this purpose. Such perimeter and network defenses are essential elements in a comprehensive medical device security strategy.

Additional security and privacy information can be found on the Philips Healthcare product security web site at http://www.philips.com/productsecurity If you are interested in overviews of validated Security Patches:

• Subscribe to the RSS Feed on this subject

• Request an account that enables you to download documents illustrating the validation status for Xper Information Management System and other Philips Healthcare products (to do so, navigate to the “Vulnerability Tables” section of the site)

4522 170 56281 CSIP Level 0 Page 27 of 46

Antivirus software is not provided with the Xper Information Management System Workstation. To protect the data stored in the Xper Information Management System Workstation, Philips recommends that you run antivirus software on any Xper Information Management System server and all workstations, and keep the antivirus software up-to-date on any Xper Information Management System server and all workstations.

Note: Philips Healthcare is not responsible for the installation or maintenance of antivirus software or for the integrity of the Xper Information Management System infected with a computer virus.

8.1.2 Audit Trails

Windows Audit trail features can be configured to log user activities which are critical to information security, and to inspect the log files on a regular basis.

Audit trail:

• applies to logging-on, reading and/or modifying clinical information

• requires the means to be provided for regular and/or automatic backup on a hospital server, e.g. the use of an external standard 'Syslog' server.

• In addition, it is advised to inspect the Windows event logging regularly to check for failed logons and failed file access.

It is recommended that the Xper IM Windows Event Log will be included in the backup plans.

8.1.3 Operational Security

To keep the system secure, it is recommended to follow proper operational security measures like:

• Password-protect BIOS

• Disable booting from external drives in the boot order

• Disable unused I/O device interfaces

• Disable unused services and ports

• Control physical access to the product (Only authorized personnel should have access)

• Create and enforce policies that ensure unauthorized users cannot gain access

8.1.4 Physical Security and Limited Access to Systems

It is important to consider physical security measures like keeping the system in a secure location, limiting access to only authorized personnel, appropriate locking measures, card-key or other access imitations, and so on. Access to systems must be limited to authorized users and controls must be implemented to ensure that unauthorized users cannot gain access.

Refer to the Xper IM System Administration Guide for steps to create users with required access rights.

8.1.5 Strong Password Policies

Strong Password policies for all the user accounts in the system are recommended.

Strong passwords help prevent unauthorized people from accessing files, programs, and other resources, and should be difficult to guess or crack. A good password:

• Is at least eight characters long

4522 170 56281 CSIP Level 0 Page 28 of 46

• Does not contain your user name, real name, or company name

• Does not contain a complete word

• Is significantly different from previous passwords

• Contains uppercase letters, lowercase letters, numbers, and symbols

8.1.6 Protecting Personal Information

It is essential that policies and procedures for the proper handling of personal or sensitive data are in place.

Consider the confidentiality, integrity, and the availability of the types of data. Each organization using this product must provide the protective means necessary to safeguard personal information consistent with each country law, code and regulation, and consistent with the company policies for managing this information.

While handling personal information is outside the scope of this document; in general, each organization is responsible for identifying:

• who has access to personal data and under what conditions an individual has authorization to use that data

• how the data is stored and the conditions by which it is stored

• how the data is transmitted and the conditions under which that data is transmitted

8.1.7 Protecting Personal Health Information

Protecting personal health information is a primary component of a security strategy. Considering the nature of the Xper IM product, the information stored is highly personal and sensitive and should be protected in accordance with HIPAA or Council of the European Union security and privacy rules.

The system does not encrypt patient health information when stored. Unencrypted patient health information will be present in the system files, backup files, and files saved to primary, auxiliary, and portable storage devices. Thus, particular care must be taken with this information when designing backup, archiving, and disaster recovery plans to ensure the utmost security and confidentiality.

Additionally, industry standard methods and best practices of applying disk level encryption may be applied to protect data at rest.