Administrator s Guide for SAP Electronic Medical Record Document Version 2.11 August 4th, 2017 PUBLIC

Transcription

1 Administrator s Guide for SAP Electronic Medical Record Document Version 2.11 August 4th, 2017 PUBLIC

2 TABLE OF CONTENTS INTRODUCTION... 4 History of Changes... 4 SAP Electronic Medical Record... 5 About this Document... 5 Purpose... 5 Related Information... 6 Further Useful Links... 6 Important SAP Notes... 7 SAP EMR SYSTEM LANDSCAPE... 8 Technical System Landscape... 8 Installation of SAP EMR Prerequisites Installation Sequence SAP Mobile Server for Healthcare Basic Configuration of SAP Mobile Server for Healthcare Basic Gateway Configuration Settings Activate ICF Services Create local alias Activate Gateway Maintain Service Only relevant if EMR Server connects to backend via webservices Basic EMR Configuration Settings Configuration of Backend Destination Create user role in SAP Mobile Server for Healthcare Maintain Users in SAP Mobile Server for Healthcare Enable HTTPS on ios EMR client SAP EMR ios App Maintain ios Client Settings Supported URL Scheme EMR Info Page Import Server Certificate Setup Intranet Site with Login Information Enable HTTPS Android EMR client SAP EMR Android App Configuration of the Client Settings Import via URL (Android, Windows) Maintain Android Client Settings Import Server Certificate Post-Installation Handle Meta Data Cache

3 Enable Meta Data Cache Refresh Meta Data Cache Enable and disable single services Security Aspects of SAP EMR User Management Single Sign On with SAP Login Ticket Single Sign On with SPNego Login with Touch ID (ios only) Data privacy & Data protection Other security relevant guidelines Business Configuration of SAP EMR Basic Configuration Performance optimization related settings Facet Configuration Extensibility Adding additional web facets to the mobile client Assign configuration for user group using role concept Other functions in configuration tool Support File Configuration settings on the device Android specific Configuration Settings Client Configuration Distribution with SAP Afaria (ios only) Use Case Afaria Server Profile Configuration Configuration Distribution Viewing Office Documents Office Documents on ios Office Documents on Android Android Hardware Compatibility Operating SAP EMR Testing the proper configuration of the EMR Mobile Server Analyze errors on the server Analyze errors on the client Evaluating SAP EMR App Log Files on ios devices Download Crash Logs from ios devices Evaluating SAP EMR App Log Files on Android devices Evaluating SAP EMR App Log Files on Windows devices Get EMR Unwired Version Information Windows devices How to execute and analyze End-to-End traces System Preparation for E2E Trace Create and Evaluate E2E Traces Analyze Performance Log

4 INTRODUCTION History of Changes The Administrator s Guide is regularly updated in SAP Service Marketplace at Make sure you have the latest version of the Administrator s Guide by checking SAP Service Marketplace immediately before starting the installation. The following table provides an overview of the most important changes that were made in the latest versions. Document Version Date Important Changes 1.0 October 2011 SAP EMR (Version 1) 2.0 June 2012 SAP EMR Unwired (Version 2) 2.1 July 2012 Several small corrections 2.2 August 2012 Several small corrections 2.3 October 2012 Several corrections 2.4 January 2013 Several corrections 2.5 April 2013 Several corrections 2.6 August 2013 Several small additions 2.7 September 2013 Several small additions 2.8 December 2013 Several small additions 2.9 May 2014 Several small additions 2.10 May 2015 New section Configuration of the Client Settings Import via URL (Android, Windows) Small change in section Uploading icons and images for web facets and facets logos Several small changes 2.11 August 2017 Corrections & new section Login with Touch ID (ios only) 4

5 SAP Electronic Medical Record Health professionals are mobile by nature of their business. Every piece of technology which helps physicians, nurses or caretakers to spend more time with patients, and less with administrative or information gathering tasks, is increasing overall employee productivity for health organizations. Physicians are information workers par excellence (depending on accurate patient and medication related information), but are severely suffering from work overload. Simplifying the way how physicians access and process patient related information will generate immediate ROI, not only because in the increase in capacity but also the overall effectiveness and quality of the work. The base concept behind Mobile EMR is to deliver patient related data (as maintained in various incumbent clinical backend systems) on the mobile device which can be easily used by physicians, nurses and care takers in context of their daily work. The application is operating in wireless mode and provides the following functionality Patient list Charts (Vital Signs) Progress notes Lab results Documents Images Demographics Coded data Medical order My favorites Take patient picture and send to backend Notes Capturing (Progress Notes, Clinical Tasks and Personal Note) Clinical tasks Individual image albums Patient list filtering Refresh of app data Text elements About this Document Purpose This document is the central starting point for the implementation of SAP EMR. You can find implementation information as well as security and operation information in this document. The Administrator s Guide consists of the following main sections: SAP EMR System Landscape In this section we do provide an overview of the SAP EMR system landscape, software components used and the respective interfaces Installation of SAP EMR In this section we do provide a step by step description for the SAP EMR related installation process. Security Aspects of SAP EMR In this section we do provide an outline for the proper management of security related aspects of the SAP EMR solution 5

6 Configuring SAP EMR In this section we provide an overview of all capabilities to configure SAP Mobile Server HC and client application towards the needs of a specific implementation project. Operating SAP EMR In this section we provide an overview of all operating relating tasks and best practices related to SAP EMR. You can find the most current of this document on SAP Service Marketplace at We strongly recommend that you use the document available here. The guide will be regularly updated. Related Information For more information about implementation topics not covered in this guide, see the following content on SAP Service Marketplace: Content Latest versions of installation and upgrade guides General information about SAP EMR SAP Business Maps - information about applications and business scenarios Sizing, calculation of hardware requirements - such as CPU, disk and memory resource - with the Quick Sizer tool Released platforms and technology-related topics such as maintenance strategies and language support Network security High Availability Performance Information about Support Package Stacks, latest software versions and patch level requirements Information about Unicode technology Location on SAP Service Marketplace To access the Platform Availability Matrix directly, enter Further Useful Links The following table lists further useful links on SAP Service Marketplace: Content Information about creating error messages SAP Notes search SAP Software Distribution Center (software download and ordering of software) SAP Online Knowledge Products (OKPs) role-specific Learning Maps Location on SAP Service Marketplace

7 Important SAP Notes You must read the following SAP Notes before you start the installation. These SAP Notes contain the most recent information on the installation, as well as corrections to the installation documentation. Make sure that you have the up-to-date version of each SAP Note, which you can find on SAP Service Marketplace at SAP Note Number Title Description Release Restrictions: SAP Electronic Medical Record Release Restrictions: SAP Electronic Medical Record Release Information: SAP EMR Release Information: SAP EMR HTTP server: expired or initial user accounts Setting up SSL on Web Application Server ABAP EMR Backend Services & Configuration 7

8 SAP EMR SYSTEM LANDSCAPE Technical System Landscape For the proper installation and administration of the SAP EMR solution it is essential to have a good overview of the overall solution architecture, the reference system landscape and the set of required components. At a high level the SAP EMR solution consists of three layers SAP EMR App for mobile devices SAP Mobile Server for Healthcare Backend Systems / Clinical Subsystems incl. SAP EMR Backend Adapter With the SAP EMR Unwired App users can access patient related data online as maintained in various backend systems on the mobile device. The SAP Mobile Server for Healthcare provides a Meta data model for the SAP EMR App in support of a strict decoupling between the App and respective backend systems. Furthermore the SAP Mobile Server for Healthcare provides configuration capabilities allowing customers to adopt the entire solution to customer specific requirements. Technically SAP Mobile Server for Healthcare consists of a Gateway System deployed on top of a SAP NW 7.02 and the EMR ABAP Add-On (Component MEMR ADAPTER). SAP EMR is designed based on open standards and can be integrated with a multitude of clinical systems. A prerequisite for the connectivity between SAP Mobile Server for Healthcare and a respective clinical system is the availability of a so called SAP EMR Backend Adapter, which is not part of the SAP standard offering. For customers using Siemens i.s.h. med and SAP ISH SAP Consulting for Healthcare is offering a respective adapter. The data flow between the various components is as follows: the SAP EMR connects with the SAP Mobile Server for Healthcare to retrieve data as triggered by the user on the mobile device. SAP Mobile Server for Healthcare connects with the clinical backend system (in case of i.s.h. med by means of RFC calls to the respective SAP EMR Backend Adapter), is retrieving the result set and sending it back to the SAP EMR App (by using OData protocol). SAP highly recommends the use of a Mobile Device Management (MDM) tool. SAP EMR Unwired is limited to the usage within the local area network through WiFi or any internet connection with VPN. 8

9 Figure 1 provides an overview of the system landscape for SAP EMR. Figure 1 - SAP EMR System Landscape The following software components are either mandatory or optional, as indicated below, for the technical implementation of SAP EMR Component Mandatory Optional Provider * SAP NetWeaver 7.02 SP09 X SAP * SAP NetWeaver Gateway 2.0 SP05 X SAP SAP MEMR Add-On 1.0 SP04 X SAP SAP EMR Unwired App X SAP Siemens i.s.h. med EHP4 & EHP5 X Siemens/SAP SAP ISH X SAP **SAP EMR Default Backend Adapter X SAP Consulting Implementation for i.s.h. med (Consulting Solution) Sybase Afaria X SAP * Alternative: You can also install the SAP MEMR Add-On 1.0 SP06 on a SAP NetWeaver 7.40 (which includes the SAP NetWeaver gateway components). For information about the installation process for this system landscape, see the following chapter. ** Important: In this table the SAP EMR Default Backend Adapter Implementation for i.s.h. med is marked as optional. This means that you can use this adapter or any other adapter developed by SAP partners. But without a Backend Adapter Implementation EMR cannot run. A Backend Adapter Implementation is not part of the standard SAP components. 9

10 Installation of SAP EMR Installing SAP EMR consists off the following major activities 1. Installing the client app on mobile devices 2. Installing the Gateway Server components in your enterprise landscape. For more information, see the Gateway Installation Guide at This consists of installation of the following components: GW_CORE 200 IW_FND 250 (Note that WEBCUIF 701 is a prerequisite of IW_FND 250) 3. Installation of Gateway Backend Event Publisher. This consists of the following component: IW_BEP Installation of required support packages of Gateway Components 5. Installing the SAP EMR Add-On on top of the Gateway System 6. Configuring a trusted connection between SAP Mobile Server for Healthcare (Gateway) and the local clinical solution Prerequisites Backend With SAP EMR Siemens i.s.h.med is supported as clinical backend solution. The respective i.s.h.med system must be installed and configured properly. Furthermore the SAP EMR backend adapter for i.s.h.med (as provided by SAP Consulting) must be deployed properly. Please contact SAP Consulting for Healthcare for detailed information. Other clinical backends can be connected via web services. Please see the respective documentation in the SAP EMR Partner Collaboration Room. Mobile Devices SAP EMR app is available in different versions which can be deployed on the following mobile platforms: ios: ipad or iphone running ios 9 or higher. Android: devices using version or higher (the app is not optimized for all devices, the user is informed on this issue during the installation process) Installation Sequence The following table provides the implementation sequence: SAP Mobile Server for Healthcare 1 Installation of SAP NW 7.02 SP07 For detailed information, see service.sap.com/instguidesnw70 The following SAP NetWeaver versions (min. SPs) are supported: SAP NetWeaver 7.0 SPS25 SAP NetWeaver 7.01 SPS10 SAP NetWeaver 7.02 SPS07 SAP NetWeaver 7.03 SPS01 SAP NetWeaver 7.31 SPS01 SAP NetWeaver 7.40 SPS01 We recommend to use the latest supported NW stack see option for step 1. 10

11 Alternatively: Installation of SAP NW 7.40 SPS01 For this option, continue with step 4. For detailed information, see service.sap.com/instguidesnw74 2 Installation of SAP Gateway For detailed information, see service.sap.com/instguidesnw70 SAP NetWeaver Gateway 2.0 The following components must be installed: GW_CORE 200 IW_FND 250 WEBCUIF 700 WEBCUIF Installation of Gateway Backend Event Publisher For detailed information, see service.sap.com/instguidesnw70 SAP NetWeaver Gateway 2.0 The following component must be installed: IW_BEP Installation of required support packages Install all support packages starting from SP 0001 to the latest support package for the Gateway components. The Gateway components are: GW_CORE 200 IW_FND 250 WEBCUIF 701 IW_BEP Only for SAP NW 7.40: Installation of ACP for SAP Mobile Server for Healthcare Before you can install MEMR_BA 100 on a SAP NW 7.4 system, you have to install the Attribute Change Package (ACP) for this component (MEMR_BA===100). The installation of the ACP follows the same process as the installation of a normal delivery package: 1. Download the ACP directly from SAP Service Marketplace via Software Downloads -> SAP Software Download Center -> Search for Software Downloads and search for MEMR_BA=== Install ACP on your system: Use the SAR archive of the ACP as you are used to by a normal delivery package. Load the package into the system by choosing the function Support Package -> Load Packages -> From Front End in the Support Package Manager, or unpack it manually using the SAPCAR utility on the application server, and then choose the function Support Package - > Load Packages -> From Application Server in the Support Package Manager. 11

12 For more information, see SAP notes and on SAP Service Marketplace under service.sap.com/notes. 5 Installation of SAP Mobile Server for Healthcare Download and install the component MEMR ADAPTER 1.0 from service marketplace ( List of required support packages for installation: MEMR_BA 100: SP 0000 (Add-On Installation) MEMR_BA 100: SP 0001 MEMR_BA 100: SP 0002 MEMR_BA 100: SP 0003 MEMR_BA 100: SP 0003 MEMR_BA 100: SP 0004 MEMR_BA 100: SP 0005 MEMR_BA 100: SP 0006 MEMR_BA 100: SP 0007 MEMR_BA 100: SP 0008 MEMR_BA 100: SP 0009 MEMR_BA 100: SP 0010 MEMR_BA 100: SP 0011 MEMR_BA 100: SP 0012 Basic Configuration of SAP Mobile Server for Healthcare Basic Gateway Configuration Settings The configuration of SAP Netweaver Gateway is documented at Navigation Path: SAP Netweaver SAP Netweaver Gateway SAP Netweaver Gateway Library SAP Netweaver Gateway Configuration Guide Basic Configuration Settings. It is recommended that you are logged in with English (EN) to perform these steps. The following steps are required: Activate ICF Services Enter Transaction SICF Press Execute Button Select path in tree /sap/public/opu /sap/opu/odata Right click on the selected node and chose Activate Service Create local alias 1. Enter transaction SPRO 2. Press button "SAP Reference IMG" 3. Navigate in Tree: 1. SAP Neteweaver 2. Gateway 3. OData Channel 4. Configuration 5. Connection Settings 6. SAP Netweaver to SAP System 7. Manager SAP System Aliases 12

13 4. Press Execute Button 5. Press button New Entries 6. Set the following values 1. SAP System Alias: LOCAL 2. Description: LOCAL 3. Local GW : Yes 4. For Local App: Yes 5. RFC Destination: NONE 6. WS Provider System: 7. Software Version: DEFAULT 7. Press save button - An pop up appears to specify a transport request. Create a new one if you don't have a request already - Press button create (icon with white sheet) - Enter any Short Description - Press save button - Confirm your changes with button Continue Activate Gateway 1. Enter transaction SPRO 2. Press button "SAP Reference IMG" 3. Navigate in Tree: - Gateway 1. OData Channel 2. Configuration 3. Connection Settings 4. SAP Netweaver to SAP System 5. Activate or Deactivate SAP Netweaver Gateway 4. Press Execute Button - Confirm dialog with "Activate" Maintain Service Enter transaction SPRO Press button "SAP Reference IMG" Navigate in Tree: - SAP Netweaver - Gateway - OData Channel - Administration - General Settings - Maintain Service Press Execute Button Press Button "Add Service" In Field "System Alias" enter "LOCAL" and press return key In the table below several services are displayed. Click on line with entry /MEMR/MOBILE_EMR A dialog comes up. In field Package enter "$TMP" Confirm tehe dialog A new entry is created in table with name ZMOBILE_EMR. Mark this entry In frame on the left upper side named ICF Nodes two entries are shown. One is ICF Node SDATA the other is ODATA. Mark entry with ODATA and press button Activate Mark entry with ODATA and press button Call in Browser A browser window comes up and requests user name and password of the system. Maintain these values and confirm the dialog. In the browser the relevant URL is now shown. It should have the following pattern: The values for <host>, <port> and <client> differs per installation. This URL is required in the configuration of the EMR mobile client. On the mobile client you have to set the URL in a slightly 13

14 different format. There the URL must not contain any query options such us?sap-client and $format. So the URL to be set on mobile device has this format: Only relevant if EMR Server connects to backend via webservices For the connection between the EMR Server and non-sap backend webservices are used. In order to optimize the connection a profile parameter needs to be configured for the EMR Server. With the profile parameter icm/max_kept_client_conns = 0 it can be ensured that opened connections are also closed again after sending the request via webservice to the non-sap backend over webservices. Basic EMR Configuration Settings Configuration of Backend Destination For the EMR Mobile Sever to connect to an clinical information backend system a central configuration has to be made. The actual backend system can be a non-sap system to which the EMR Mobile Server connects through webservice or a SIEMENS i.s.h. med system where the connection is done through SAP RFCs. The following diagram illustrates the different deployment options and lists the related configuration entry to be maintained in transaction /n/memr/config_ui. Scenario 1: In case a non-sap backend is connected to the mobile server create a configuration as follows: Enter transaction /n/memr/config_ui. Select tab Configuration and press button Change. Press button Append row and add the following values: Field Value Configuration Key /MEMR/FUNCTION_DESTINATION User Name User Role Read Only X Configuration Value NONE 14

15 For additional information please also consider SAP note Scenario 2: For security reasons a trusted RFC connection should be used for the commuication between the two SAP systems. For this the EMR Mobile Server must be added to the list of trusted systems in the i.s.h. med system. To do this perform the following steps in the i.s.h. med system: 1. Create a RFC connection from i.s.h. med system to the EMR server by using transaction SM59. Set "Trust Relationship" to "No" 2. In i.s.h. med system enter transction SMT1. Press Create Button and enter the RFC destination from previous step. Complete the wizard. 3. Create a trusted RFC connection from EMR Moblile Server to i.s.h. med system as described in next parapraph More details about trusted RFC connection can be found here: Scenario 2 & 3: In case a SAP backend is connected to the mobile first create a RFC connection and then create an entry in the configuration /n/memr/config_ui as follows: 1) Create an RFC connection Enter transaction sm59. Click the create Icon. Fill out the following fields: Field Value Example RFC Destination Alpha Numerical value SIDCLNT001_T Connection Type 3 (ABAP Connection) n.a. Technical Settings -> target Host address Emrserver.company.com host Technical Settings -> System ID of the i.s.h. med SAP system 42 Number Logon & Security -> Current Flag this field so it is marked n.a. User Logon & Security -> Trust Choose yes from the available radio n.a. Relationship buttons Logon & Security -> Trust Relationship Choose "Yes" in case of Scenario 2 (2 Box deployment), otherwise "No" n.a Click Connection Test to test the RFC connection. Hit save to save your settings. 2) Configure the EMR Function Destination Enter transaction /n/memr/config_ui. Select tab Configuration and press button Change. Press button Append row and add the following values: Field Value Configuration Key /MEMR/FUNCTION_DESTINATION User Name User Role Read Only X Configuration Value <RFC DESTINATION NAME> The value to be set in field Configuration Value is the name of the trusted RFC Connection created in previous step. Press the save button. Create user role in SAP Mobile Server for Healthcare For security reasons it s recommended that the users on the SAP Mobile Server for Healthcare that uses the EMR mobile client do have a minimum set of authorizations on this system. To achieve this you can create a new role in transaction PFCG and use the following templates: 15

16 /IWBEP/RT_BEP_USR /IWBEP/RT_MGW_USR /IWFND/RT_GW_USER Also add the following authority objects to the role: S_SERVICE (required to allow to connect via HTTP) S_RFCACL (required for trusted RFC connection) Maintain Users in SAP Mobile Server for Healthcare On the mobile client you have to login with user and password. For this the corresponding user must be present on SAP Mobile Server for Healthcare as well as the backend. This means that the user id must be the same on the ipad client, the SAP Mobile Server for Healthcare and the SAP backend. The password on the backend can differ from these on the mobile client and SAP Mobile Server for Healthcare. This means on the device the user logs on with its credentials defined in SAP Mobile Server for Healthcare. The following table shows an example: System User Password SAP Backend USER1 xxx SAP Mobile Server for USER1 yyy Healthcare EMR mobile Client USER1 yyy Assign the role created in previous section to the users on this system. Enable HTTPS on ios EMR client It is strongly recommended to configure the ICF to use HTTPS protocol instead of HTTP due to security reasons. Because of this you should perform the following steps: - Enable HTTPS for secure communication. For more details check SAP Netweaver Gateway Documentation at Navigation Path: SAP Netweaver SAP Netweaver Gateway SAP Netweaver Gateway Library SAP Netweaver Security Guide Network and Communication Security Configuring Secure Communication in Your Landscape via SSL SAP EMR ios App 1 On the ipad open the App Store application and start a search. 2 Search for the application SAP EMR 3 Choose the Install Button 4 Maintain Settings 5 Import Server Certificate Please refer to latest notes on SAP Service Marketplace for up to date information on Apple related volume installation process for SAP Apps. Maintain ios Client Settings On the ipad launch the Settings application. There is an entry for SAP EMR. Tab on this entry. On the right side you enter the URL. It should look like: <host> is the hostname of the SAP Mobile Server for Healthcare and <port> the configured (HTTPS) port. 16

17 Enter the client of the SAP Mobile Server for Healthcare. Ensure that Demo Mode is switched off. Supported URL Scheme The mobile Apps can be started on the mobile device via a URL scheme that contains configuration information to be applied. The URL scheme needs to start with protocol "com-sap-mobile-emr-v2://" followed by path "setting/ ". After this path a list of paramters can be added with syntax Paramter='Value' If several parameters are appended a "&" sign must be used as seperator. Example: com-sap-mobile-emr-v2://settings/paramter1='value1'&parameter2='value2'&parameter3='value3' Note that parameter and value needs to be URL escaped. For example a question mark ("?") needs to be escaped as "%3F", a space (" ") with "%20". Example Wrong: ParameterQuestionMark='test?abc' Correct: ParameterQuestionMark='test%3Fabc' This is a complete list of all supported Parameters: Parameter Mandatory Description backendurl Yes The URL of the SAP Mobile Healthcare Server OData Service Document clientid Yes The sap client ssourl No Single Sign On URL infopageurl No URL of the web page to be shown on the login screen if user presses the login button This is another example with all parameters included: Instead of entering these settings manually you can also make use of the URL scheme of EMR application by offering a link which is opened on the ipad Safari Browser. This URL scheme should have the following pattern: com-sap-mobile-emrv2://settings/backendurl= &clientid=<client> com-sap-mobile-emrv2://settings/backendurl=' ps://backendhost:port/sso/logon%3fsapclient=001'&infopageurl=' EMR Info Page On the login screen of the EMR Unwired App a button can be dispalyed with an info icon. If user presses this button a web page is displayed. The URL of this web page can be configured in the settings or imported via URL scheme or Afaria configuration. The intention of this info page is to have a public site with helpful user information before logon. This info page can also be used to offer a password change dialog. The SAP Mobile Server for Healthcare offers a default web page that can be used for this purpose. This default passoword change web page can also be adjusted via configuration. A detailed documentation for that is available here: 17

18 m Import Server Certificate To establish a HTTPS connection from ipad to SAP Mobile Server for Healthcare the mobile device needs the certificate of the server to ensure that the data is transferred securely. It s important that the transfer of this certificate is done in a protected environment. One way to import the certificate is to place the.cert file on a secure intranet page and use the Safari Browser of the ipad to import it. Another way of transport is to send this certificate via to the ipad and use the Mail App to open it. Setup Intranet Site with Login Information To ease the first login into the EMR application it is recommended to setup a HTML based intranet site where all relevant data for the user can is available. The following is a HTML code snipped which can be used as template: <html> <head>emr ipad Login Instructions</head> <body> <h1>emr ipad Login Instructions</h1> <ul> <li>before you can work with your ipad please use your desktop computer to login to SAP Mobile Server for Healthcare XXX with the SAP Logon tool and set a password (if not already done)</li> <li>use the Safari Browser of your ipad and click on <a href="pathtoservercertificate/xxx.cert">this link</a>. A pop up will appear to import the certificate. Confirm this dialog </li> <li>use the Safari Browser of your ipad and click on <a href=" comsap-mobile-emrv2://settings/backendurl=&#39; R&#39;&clientid=<client>">this link</a>. This will configure the EMR application to use the AG1 system where you have set the password in previous step</li> <li>use the ipad application EMR to login with user and password of the SAP Mobile Server for Healthcare system</li> </ul> </body> </html> Enable HTTPS Android EMR client It is strongly recommended to configure the ICF to use HTTPS protocol instead of HTTP due to security reasons. Because of this you should perform the following steps: - Enable HTTPS for secure communication. For more details check SAP Netweaver Gateway Documentation at Navigation Path: SAP Netweaver SAP Netweaver Gateway SAP Netweaver Gateway Library SAP Netweaver Security Guide Network and Communication Security Configuring Secure Communication in Your Landscape via SSL 18

19 SAP EMR Android App 0 For Android < 4.0. SAP EMR has to be installed before the import of the certificate. 1 Copy your https certificate onto the local file system of the device 2 Navigate to the file system location containing your certificates using the previously installed file browser. 3 Choose the certificate file. 4 Select SAP EMR Client from the presented application list. Android will automatically import the certificate. Allowed certificate types are:.cer.cert.crt Certificate names must not contain.. Prerequisite: Find and install a file browser for Android, for example from the Google Play Store (If your device doesn t have one) If only SAP EMR is installed Android will directly start to import the certificate without presenting an application chooser window. Configuration of the Client Settings Import via URL (Android, Windows) You can make several configuration settings on the SAP Mobile Server with regard to the import of client settings, such as backendurl, clientid, ssourl, infopageurl. To maintain the configuration keys, go to the SAP EMR Configuration UI (transaction code /MEMR/CONFIG_UI) on the SAP Mobile Server. Create the following entries and maintain the configuration values according to the desired behavior: /MEMR/CLIENT_CONF_SERVER_CHANGE/ALLOWED/URL_SCHEME_IMPORT By default the automatic URL_SCHEME_IMPORT of server configurations on the client is not allowed; to allow automatic changes of the server configurations, set X for URL_SCHEME_IMPORT on the client. /MEMR/CLIENT_CONF_SERVER_CHANGE/HOST_URL_PATTERN By default all HOST_URL_PATTERN are allowed; if required, specify allowed HOST_URL_PATTERN, for example example.corp. The pattern may be fully qualified host names or domains. Domains need to start with a dot ("."), for example.exampledomain.corp. Several host names or domains are possible. For this, separate them with a semicolon (";"), for example int.example.com;ext.example.com;.domain.com. /MEMR/CLIENT_CONF_SERVER_CHANGE/PROTOCOLS By default all PROTOCOLS are allowed; if required, specify allowed PROTOCOLS, for example https. Several protocols can be listed as a list separated by a semicolon (";"), for example https;http. Maintain Android Client Settings Start SAP EMR Client and choose Settings located at the bottom right of the Logon Screen. In the Settings configure the Backend Server URL to reflect the following schema: <host> is the hostname of the SAP Mobile Server for Healthcare and <port> the configured (HTTPS) port. 19

20 Enter the client of the SAP Mobile Server for Healthcare. Ensure that Demo Mode is switched off. Import Server Certificate Certificate import is automatically handled by Android when selecting the certificate from the mobile client file system. There are no additional steps required. Post-Installation Please refer to SAP NetWeaver Gateway Installation Guide to perform necessary post-installation tasks to understand how to log on to the newly installed Gateway system how to start and stop the system how to access documentation on how to apply support packages and patches Handle Meta Data Cache In a productive environment it is strongly recommended to make use of the meta data cache to improve performance and scalability. There are three levels of meta data caches: - SAP NetWeaver Gateway Metadata Cache - IW_BEP Metadata Cache on SAP Mobile Server for Healthcare More information about this topic is available on Gateway documentation on Navigation Path: - SAP Netweaver Gateway - SAP Netweaver Developer Guide - OData Channel - OData Channel Generic Aspects - Metadata Cache Enable Meta Data Cache On Gateway Server System enter transaction /n/iwfnd/med_activate. Confirm the dialog to activate the cache Refresh Meta Data Cache The meta data cache should be refreshed after the following processes: - A support package of MEMR or any Gateway component has been installed - The backend adapter has been updated SAP NetWeaver Gateway Metadata Cache To refresh cache on IW_BEP Metadata Cache on SAP Mobile Server for Healthcare: 20

21 - Enter transaction /n/iwfnd/cache_cleanup - Mark checkbox Cleanup Cache for all Models - Press Execute button Enable and disable single services With Support Package 2 of ABAP component MEMR several new services have been added e.g. to create clinical tasks or adding attachments (photos or voice memos) to clinical tasks. Per default all these services are not enabled. The UI on the mobile client also reflects this behavior and so there is no button e.g. to create clinical tasks per default. To enable a service it needs to be configured using transaction /n/memr/config_ui. For each service there is a configuration key that is not shown in the value help. The SAP implementation partners has access to all these keys and values and can offer a corresponding configuration file you can upload that is specific to your custom backend development. Only after maintaining these entries all features of SAP EMR Unwired are available on mobile client. This concept can also be used if some features should not be used at all. For example you can decide to not make use of the attachment concept on progress notes and clinical tasks due to limit storage capacity in backend. In this scenario you have to remove the relevant functions from the configuration table. Security Aspects of SAP EMR User Management The SAP EMR solution doesn t provide an app specific user management or authorization concept, but is leveraging user management of SAP NetWeaver Gateway (for SAP Mobile Server for Healthcare connectivity) and user management of the respective backend system (e.g. Siemens i.s.h. med) In order to use the SAP EMR app the following user management related tasks need to be done 1. Export the user accounts from the clinical backend system 2. Import the users into the SAP Mobile Server for Healthcare (NetWeaver Gateway System) 3. Inform the users that they have to initially login to the SAP Mobile Server for Healthcare and change their password. The SAP Mobile Server for Healthcare / Gateway password should be the same as in the clinical backend system. After completion of these tasks users can authorize themselves in the SAP EMR app with the same credentials as used in the backend system. To ensure that users can not log on in case the password is still in the initial state (set by the administrator) or the password is expired please consider SAP note Using the info page on the logon screen a password change process can implemented via configuration. There are no specific SAP EMR users or default passwords. Please refer to SAP NetWeaver Gateway for respective detailed information. Same applies to user synchronization options with external systems. SAP EMR solution doesn t provide user roles. 21

22 Single Sign On with SAP Login Ticket The ios version of EMR Unwired supports Single Sign on with SAP Login Ticket. This feature can be used if the following prerequisites are fulfilled: - Backend System is an SAP Application Server such as the i.s.h. med product - Backend System and Mobile Server are both in the same domain. To be more precise it's HTTPS addresses must be in the same domain - Backend System and Mobile Server are both configured to use HTTPS (SSL) - Mobile Client can reach both servers in the network To use this Single Sign On functionality both backend system as well as SAP Mobile Server must be configured accordingly. A detailed description about that is available in SAP Netweaver documentation: This is a shortened summary about the relevant steps. 1. Enable backend to create logon tickets Set profile parameter to create SSO ticket without certificate: login/create_sso2_ticket = 2 Alternative values: - 0 : Ticket generation deactivated - 1 : SSO ticket including certificate - 2 : SSO ticket without certificate For security reasons strongly recommended: Create certificate only if client logs in with HTTPS (and not HTTP). Set profile parameter login/ticket_only_by_https = 1 2. Define ICF node in backend that is used for login The mobile client needs to send a login request via HTTPS to backend. This means we require an ICF node on ABAP side that servers as a kind of ping. One possibility to do this is to create a new custom ICF node in the root tree that is dedicated to serve as client login. However if there is already an existing ICF node in backend that fits your need you can go ahead with this one. 3. Export Public Key from backend system The Mobile Server needs to trust logon tickets created by the SAP backend system (AS ABAP). To set up this trust relationship execute the following steps: - Logon to backend system - Start Transaction STRUST - On the left side tree click on item below System-PSE - On the right side you see the system certificate. Double click in the text box. You should now see the details of the certificate in the lower box (Certificate). - Press button "Export Certificate" - As data format select binary and save the file using extension.crt 4. Import Public Key into Mobile Server - Logon to mobile server - Start transaction STRUST - On the left side tree click on item below System-PSE - Press button "Import certificate" on the lower right panel - Select the.crt file from previous step - Press button "Add to Certificate List" - Save your changes 22

23 5. Enter backend's certificate in Mobile Server's ACL - Logon to mobile server - Start Transaction SM59 and create a RFC connection to backend system. Note down the name of the RFC destination - Start transaction SSO - Enter backend destination name - Press Execute - Press activate button on the left upper side (Enter Certificate in ACL) or use F9 - You should now see three green lights 6. Apply settings on mobile device On the mobile device open the settings page. Enter the Singe Sign On URL that points to previously mentioned ICF node in backend system. Single Sign On with SPNego The SAP EMR Unwired app for Windows 8 supports authentication via SPNego. This requires SAP NetWeaver Single Sign-On 2.0 to be installed and its SPNego module to be configured on the SAP Mobile Server for Healthcare. For information, see If SPNego is correctly set up, the configuration for the app on the Windows 8 device needs to be adjusted. To do so, start the app and enter the Settings Charm on the logon screen and click on Preferences. Enable the switch for Enterprise Authentication. Login with Touch ID (ios only) Note: ios devices are single-user devices. The use of Apple s Touch ID should only be allowed in a personal device - policy environment. The SAP EMR Unwired app supports Apple s Touch ID functionality, which allows you to login by using your fingerprint. As a prerequisite, Touch ID must be centrally managed by the administrator using a MDM tool. To allow Touch ID for your users, please set the key com.sap.mobile.emr.istouchidallowed to true. To make use of this feature as a user, you will need an ios device with Touch ID (iphone 5s or later, ipad Air 2 or later). Please go to the ios Settings and enter section Touch ID & Passcode. Please save your fingerprints accordingly. To enable Touch ID for SAP EMR Unwired as a user, go to the ios settings and navigate to EMR Unwired. Enable the option Enable Touch ID. Now open the SAP EMR Unwired app and login with your credentials. You will now be asked if you would like to activate Touch ID. Please follow the process as displayed in the app. Data privacy & Data protection SAP EMR solution is designed in a way to assure highest security standards. In this regard the following principles apply 23

24 1. Besides the retrieval of patient related data from (project specific) clinical backend systems (or sub systems), SAP EMR Unwired allows to create personal notes, clinical tasks and progress notes in the clinical backend. Those functions can easily be disabled in the configuration tool. 2. Authorizations for read and write access for those data are exclusively handled by the respective backend system (e.g. i.s.h. med solution). 3. No patient related data are permanently persisted on the device. Only for performance improvement reasons selected data (especially images) are locally cached. Caches are automatically deleted after session end, and are encrypted. 4. As part of the take picture functionality users can take a picture of a patient and submit to a connected backend system. The picture is not persisted on SAP EMR client device or SAP Mobile Server for Healthcare. It is in the responsibility of the customer to assure that the handling of patient related personal data (the image) is compliant with local regulation in regard to data protection. In particular patients need to agree to the storage of their personal data. Furthermore customers need to take care of processes to delete those data if requested by a patient. Finally it is recommended best practice to log all access activities to those personal data. Related processes are not touched / covered by SAP EMR solution, but need to be handled in context of the respective implementation project. The feature can be disabled in the configuration menu of the SAP Mobile Server for Healthcare. 5. Logging of security relevant events (read and write access) and the respective analysis needs to be handled by the respective backend systems. Proper handling needs to be assure in context of the respective SAP EMR implementation projects. Other security relevant guidelines 1. More security relevant details are listed in the EMR Security Guide. 2. SAP EMR solution stack comprises the following communication channels : a. Between mobile device and SAP Mobile Server for Healthcare: OData channel over https b. Between SAP Mobile Server for Healthcare and backend system : trusted RFC 3. RFC destinations have to be maintained in the Gateway system as part oft the initial installation process, depending on the respective system landscape. There are no other RFC destinations as part of SAP EMR standard solution. 4. If a customer integrates web facets into the application it is in the responsibility of the customer to assure secure handling of respective site. Our recommendation is to only link to trusted sites. 5. In regard to a secure network setup it is recommended to refer to the respective SAP NetWeaver Gateway security guides. 6. In regard to needed resources for the SAP EMR platform it is recommended to consult the respective Gateway sizing guidelines. 7. It is strongly recommended to configure the SAP EMR App to communicate via https with the EMR mobile server. 8. Certificates which are used to establish a secure HTTPS connection between the ipad client and the EMR Server have to be distributed in a secure environment where man in the middle attacks can be ruled out safely. 9. SAP EMR for Android enables end users to choose their own pdf document reader. For this feature to work, the mobile android client downloads a copy of the document from the attached backend and stores a temporary version of it in the client s sandbox as World Readable file. Every external mobile client then has access to this file if the file url is known to them. Once the read request from the external document reader has been received, the temporary copy of the file is removed from the sandbox. It could however be possible for external clients to cache the retrieved data binary of the document in their own sandbox. Business Configuration of SAP EMR The Business configuration of SAP EMR can be categorized into four areas: 1. Healthcare Backend connectivity Configuration How to connect a healthcare backend 24

25 2. SAP Mobile Server for Healthcare Configuration How to configure the SAP Mobile Server for Healthcare 3. SAP Electronic Medical Record mobile client How to configure the SAP Electronic Medical Record mobile client 4. SAP Afaria Configuration How to configure SAP Afaria to be able to distribute backend configuration to SAP Electronic Medical Record mobile clients Besides the backend connection configuration all other settings are optional and can be performed by processing a few ABAP programs and/or maintaining customizing tables. For all desired mobile users, the user ID from the backend has to be created as well in the EMR Mobile Server. In the user administration, to all users the PFCG role SAP_MEMR_EMR_PRACTITIONER has to be assigned. Please note that the user needs the authorization for object S_SERVICE (see also: m). For the proper authorization on the trusted backend system, the user also requires the S_RFCACL in the backend system (see also: Basic Configuration With SAP EMR Unwired, a new configuration tool is offered that allows a more user-friendly configuration. Start the tool with transaction: /n/memr/config_ui. The configuration tool contains three main tabs: General configuration (e.g. branding, layout, security and technical aspects) Facet configuration (e.g. links to html sites) Support files General configuration. This table offers a generic key value configuration with the following fields: Configuration Key User Name Role Category Configuration Values Attachments Technical key for the configuration (see table below of options) To allow different configurations for different users. If the user name field is kept empty, the settings apply globally. To allow different configurations per role. System checks in following order: User Name settings lead over role settings. If a setting is assigned to a user and a role the user specific setting takes effect. The category helps to better group the entries. Configuration value see table below for options Attachments can be icons for the log-on screen, or files containing branding information. Following settings can be maintained. Most keys are available in an F4 help: CONFIG_KEY CLIE NT_R EL. CONFIG_VALUE Description 25

26 /MEMR/FUNCTION_DESTINATION No <Name of destination in SM59> /MEMR/CLIENT_CACHE_MAX_AGE NO <Max age of cache in seconds> /MEMR/CLIENT_CACHE_MAX_AGE/<name> No <Max age of cache in seconds> The name of the backend destination. Check Transaction SM59 to get the correct value Maximum time for the client to cache data received from middleware Maximum time for the client to cache data received from middleware for a specific function identified by <name> /MEMR/IMAGE_PREFETCH/IMAGE_GROUP_CO No <count> Maximum count of image groups to be pre-fetched. UNT Pre-fetching of images enhances the felt performance of the application for the end-user. It has to be set wisely to ensure that the server load does not get to high. /MEMR/IMAGE_PREFETCH/COUNT_OF_SERIES No <count> Maximum count of image series to be pre-fetched. /MEMR/IMAGE_PREFETCH/COUNT_OF_IMAGES _PER_SERIES /MEMR/IMAGE_PREFETCH/COUNT_OF_THUMB NAILS_PER_SERIES Negative value to pre-fetch all series. Zero for none No <count> Maximum count of image per series to pre-fetch. Negative value to pre-fetch all images of the series. Zero for none. No <count> Maximum count of image thumbnails to pre-fetch. Negative value to pre-fetch all thumbnails of the series. Zero for none. /MEMR/IMAGE_PREFETCH/ALL_KEY_IMAGES No X or blank Flag to pre-fetch all key images of a fetched images series. PATIENT_HEADER_CAN_BE_HIDDEN Yes X or blank Flag if the user should be able to hide the patient header on the mobile client. SAVE_LOGIN_HISTORY Yes X or blank Flag if the last 5 logged in users should be persisted on the mobile client. Note that only the login user, user name and picture is stored. For security reasons the password is not persisted on the device. Two weeks after the last login, a user name is not shown anymore. USER_FACET_CONFIG_DISABLED Yes X or blank Flag if the user should be allowed to adjust the facet ordering on the mobile client. PATIENTSEARCH_ORDER_SEARCH_BY_WARD Yes <number> Order of the search/ filter "My Wards". Default value is "1". Use "0" to disable this list. The sequence of the list displayed can be set in the configuration. If a list is not used in your hospital it can be hidden. PATIENTSEARCH_ORDER_MY_PATIENTS Yes <number> Order of the search/ filter "My Patients". Default value is "2". Use "0" to disable this list. PATIENTSEARCH_ORDER_MY_FAVORITES Yes <number> Order of the search/ filter "My Favorites". Default value is "3". Use "0" to disable this list. PATIENTSEARCH_ORDER_MY_APPOINTMENT S Yes <number> Order of the search/ filter "My Appointments". Default value is "4". Use "0" to disable this list. CUSTOM_APP_TITLE Yes <name of the title> Customized title of the application shown on the login screen. CUSTOM_APP_ICON Yes <name of the icon> Icon name shown on the login screen. The name is used as p_key to be entered in program /MEMR/BINARY_CONFIG_UPLOAD to upload the corresponding icon. See section below for details, for example MY_HOSPTIAL_ICON PATIENT_SELECTION_PREFETCH_THRESHOL D Yes <threshold in seconds> Used for image data pre-fetch. Setting a value for this key causes the client to send an image pre-fetch request to the SAP Mobile Server for Healthcare after a patient has been selected on the patient list and the configured time in second has passed on this patient selection. IMAGE_PREFETCH_ENABLED Yes X or blank Flag to enable or disable the image pre-fetch from client. LOGIN_TIMEOUT Yes <value in seconds> Login timeout. If the mobile client application is in background and is re-launched, the system can automatically log out the user for security reasons. This also happens if the mobile client has been locked. This value specifies how many seconds should pass before an automatic log out is performed by the mobile client. If this paramter is not set the mobile client uses the default value of 300 seconds. PATIENT_PHOTOS_DISABLED Yes X or Blank Flag to disable the Patient Photo feature. If disabled, photos of patients are not shown anymore. /MEMR/CUSTOM_STYLESHEET Custom Style sheet to be applied on client see excurse below for details /MEMR/EXTERNAL_APP_LABEL/IMAGE_GROUP Name of the external PACS viewer that can be used to show Image Studies. This value is used as label in the EMR Image facet. /MEMR/EXTERNAL_URL_SCHEME/IMAGE_GRO UP External URL Scheme pattern that should be used to open the external PACS viewer. The following variables are supported: $EMRImageGroup.ID$ $EMRImageGroup.ExternalPatientId$ $EMRImageGroup.PatientId$ $EMRImageGroup.AccessionNumber$ 26