P01 Technical Specifications.pdf

MAR-0000199 Rev. 04, FFRangio system IT and network information Form Page 1 of 5

FFRangio System IT and Network Information (Model FAU01000)

Section 1: Device Summary

System/ Device Name: CathWorks FFRangio™ System (or “FFRangio”)

Description/Type of Device: The FFRangio system is a non-invasive software device that analyzes angiograms to provide physicians with a quantitative assessment of the functional significance of coronary lesions, similar to invasive FFR (Fractional Flow Reserve), and a digital three-dimensional model of the coronary arteries, during routine PCI procedures.

The FFRangio™ system can perform all required processing and calculations based only on angiography images that are acquired during the coronary catheterization procedure.

The FFRangio technology does not require any additional use of invasive devices nor any vasodilation treatment, as required by other known FFR technologies.

The FFRangio system is to be located inside the catheterization room or in the control room. The system contains a processing unit and user interface control station, requiring only connections to mains electricity, grounding and a DICOM communication port. The system supports visual media output to the Cath Lab main displays (boom) in order to display the system GUI from there. The system also can send final reports to the hospital PACS system (if requested by the hospital).

(1) FFRangio screen; (2) FFRangio processing unit; (3) FFRangio cart; (4) FFRangio results displayed on Cath Lab main screen.

Form Page 2 of 5

System Components: FFRangio is a standalone configuration that receives DICOMS from the C-Arm. The system includes the following components:

Processing unit (provided in a hard case closed with bolts).

• HP Z2 Workstation PC.

• Processes data (DICOMs) received from a C-arm.

• Conducts 3D and FFR calculations.

• Presents output graphical display to the user.

• Optional configuration to send results to PACS.

User Interface (UI) Unit

• User control on processing unit (Dell touch screen).

• Additional display to BOOM.

System Input

• Routine coronary angiography images acquired during procedure

• Patient mean aortic pressure (MAP), entered by user

Device Location (Facility / Department): Cath Lab or control room, with access to power and active network socket.

Manufacturer/Vendor: Cathworks Ltd. (CathWorks Ltd is ISO 27001 certified)

Vendor Contact Information (Name / Phone / Email):

CathWorks Inc.

65 Enterprise, Aliso Viejo, California

Hardware Model/Version: FAU01000

Planned Disposition: ☒ Retain ☐ Upgrade ☐ Replace/Retire

System and O/S support provider:

CathWorks. CathWorks maintains ownership of equipment and will perform services, maintenance, and upgrade services at CathWorks cost.

Operating System & Version: Windows 10 pro (not active directory integrated)

Patch Level and Last Patch Date: Latest patches are delivered during routine software upgrades

When implemented, will the device be on the hospital network?

☒ Yes, on the VLAN where the C-arm is ☐ No

Does device use a wireless network or have access the Internet?

☐ Yes ☒ No, the only network connectivity supported by the system is the internal

DICOM VLAN

Is device accessed remotely? ☐ Yes ☒ No

Is device data backed up? ☐ Yes ☒ No, the user is instructed to export to DVD

Is device portable? ☒ Yes, can be moved between rooms, needs to be reconnected to LAN ☐ No

Form Page 3 of 5

Section 2: Access Policy Requirements

Local User Accounts: 3 local users accounts are used:

First is the application user “CWX user” which contains a propriety shell that runs the application - it logs in automatically when you turn on the system. This user has a strict security policy.

Second is a service user “CWX service” which contains a propriety shell for which service engineers run maintenance tasks like installing windows updates & patches, configuring network settings, and installing software updates.

Third is the administrator user, “CWX admin” which only the service engineers have authorization to use.

Access Protection: Client access is limited to the application interface. This interface is run by a propriety shell which allows only needed whitelisted applications. In addition, all drives are encrypted using BitLocker. A password is required to enter the computer BIOS.

All other maintenance interfaces are managed and controlled by the Vendor authorized personnel by using an encrypted and signed ESD (External Storage Device).

Do users have unique User IDs/passwords?

☐ Yes ☒ No. The system user will be automatically logged on to the FFRangio application, using a proprietary application user shell (FFRangio is the only whitelisted application).

Do passwords expire? ☐ Yes ☐ No ☒ NA

Is all data access logged? ☐ Yes ☒ No, device supports real time decision making

Does device store PHI?

☒ Yes ☐ No FFRangio receives DICOMS from a C-arm. The DICOMS holds PHI data. FFRangio only stores DICOMS received from a C-ARM on the system disks that are BitLocker encrypted. FFRangio does NOT use a database to store medical records.

Does device use removable media?

☒ Yes, System burns to DVDs only – other removable storage is disabled in user mode. In service mode, only encrypted and signed devices by CathWorks can access the system.

☐ No

Does device have malware protection?

☒ Yes, Windows Defender.

☐ No

Is data storage encrypted? ☒ Yes, all (2) disks are encrypted with BitLocker ☐ No

Firewall information: The local Firewall is set to reject all inbound/outbound connections, except the ports outlined in section 3.

Form Page 4 of 5

SDLC Lifecycle: The SSDLC (first S = Secure) incorporates information security and cybersecurity considerations, as defined in ISO 27001 and FDA cybersecurity guidelines. The Vendor performs security risk analysis as part of its overall hazard and risk analysis, including a security section in the software design and performs code reviews against its security designs. During development and prior to release, the Vendor runs vulnerability scans. At least once a year and with major software releases the Vendor performs 3rd Party Penetration tests.

Security Tests: CathWorks performs penetration tests periodically to ensure maximum security.

Section 3: Networked Equipment Requirements

Design Overview:

FFRangio is a standalone configuration that receives DICOMS from a C-ARM on port 4000, thus it needs to be part of the C-Arm VLAN. In addition, FFRangio needs to be configured as a node on the C-Arm. The FFRangio system can also be configured to send a final report to the PACS system by opening the PACS relevant port and IP address to FFRangio.

Ethernet connectivity: An available Ethernet port inside each designated Cath Lab, operable under the same network as the C-arm

Connection Type: ☒ Reservation (static) ☐ Dynamic

Are you requesting a new IP Address?

☒ Yes (operable under the same network as the C-arm) ☐ No

Network Protocol/Port(s): TCP/IP, port 4000

• Inbound allowed TCP ports: 4000, 104

• Inbound allowed UDP ports: 67,68 (allow DHCP)

• Outbound allowed TCP ports: If applicable, PACS port number only.

Otherwise, none.

• Outbound allowed UDP ports: 53,67,68 (allow DNS and DHCP)

• All other ports are closed

Connectivity to X-ray C-arm machine required?

☒ Yes ☐ No

Connectivity to C-arm details: MAC Address: Available upon serial number assignment Host name: CWX+SN (e.g., CWX123456) IP address: Configured by the hospital AE title: CWX+SN (e.g., CWX123456) Port: 4000 Image export resolution: minimum of 700*700

System Privileges required: ☒ Admin: Will only to be used by a CathWorks authorized expert when setting up the system and used only during the manufacturing process.

☒ Privileged Service User: will be used only by authorized CathWorks customer service on site

Connectivity to PACS available ☒ Yes, per hospitals network requirement ☐ No

Connectivity to PACS details Destination name, IP address, AE title, Port number as provided by the hospital

Form Page 5 of 5

Section 4: Networked Topology