1. Emerging Infectious Program (EIP) Web Service CHIIC Update May 12, 2015 Jason Hall – NCEZID, CDC Sreeni Kothagundu, Northrop Grumman – NCEZID, CDC National Center for Emerging and Zoonotic Infectious Diseases Emerging Infections Programs (EIP)

2. EIP Web Service  Background  Enhanced EIP Web Service  EIP Web Service Architecture  Next Steps

3. What is EIP?  The Emerging Infections Programs (EIP) is a population-based network covering 15% of the population and consists of projects to improve patient outcomes through evaluation and improvement of emerging infection prevention and control methods.  Over 40 projects and around 20 special studies  A collaboration of CDC, state health departments, universities, hospitals, and other federal agencies.  Over 500 publications

4. EIP IT  Mix of information system types – study databases, case information management systems, site systems  Systems used for projects can vary by site  Multiple transport methods in use  Project protocols can change yearly  Adopted IT Strategy in 2012

5. Problem  CDC-developed case management system  Two installations – CDC and at each site  Current process was cumbersome and open to errors  Export to file from one system and upload to other

6. Existing alternatives  SAMS  PHINMS  SFTP

7. Current EIP Web Service Existing EIP Web Service release 1.5 - Supports only a single EIP Program - Designed as proof of concept - Minimally extensible architecture Enhanced Web Service aligns with key strategic EIP IT goals: - Improve and modernize current EIP technology - Adapt and transform PH information is and will be exchanged, expanding use of EHR data, utilizing other or novel sources EIP IT Goals align with CDC surveillance strategy goal: …accelerating the utilization of emerging tools and approaches to improve the interoperability, availability, quality and/or timeliness of surveillance data

8. EIP Web Service v2.0  Is reusable by other C/I/O’s  As CDC Shared Services, with appropriate resources to NCEZID for additional support personnel and expansion to more scalable server configurations  Changed the framework and service to support a second EIP program  Provides support for new data interfaces through  Requires only configuration and minor development specific for new data

9. EIP Web Service – Data Flow  Data transport protocol designed for use between state surveillance information systems and CDC  State surveillance information systems invoke EIP Web Services (in CDC DMZ) to fulfill the application requests to transfer non-PII data to CDC  EIP Web Services logs and stores received data in EIP Repository is shared with EIP CDC programs.

10. EIP Web Service Service Oriented Architecture Overview

11. EIP Web Service - System Architecture

12. Modular Approach  Adopted SOA – Service Oriented Architecture  Every function / feature is a service that can be hosted in the CDC DMZ  All the services can be shared and reused with minimal effort  EIP Services can be shared with other programs or other CIOs can hosted

13. Custom Security  OCISO approved custom IP based security  Machine to machine communication  Communication using HTTPS only. (HTTPS ports only)  Passwords are encrypted; no clear password text  IP based security; IP extracted on the fly from SOAP requests  Why not SAMS authentication?  No API available for SAMS  SAMS does not support SOAP  SAMS Identity proofing is limited to humans/users, not for the machines

14. Multiple IP Support  ITSO does not support implementing firewall rules at the application level  All standard IPs are enabled by default  Supports range of IP addresses from States  Supports limited and logical firewall rules  Unauthorized IPs blocked by EIP WS and requests logged without processing  Supports both IPV4 and IPV6 addresses

15. Extensible  EIP WS are SOAP-based services  Expandable to RESTful services  Easily extensible for two-way data communication between states and CDC  Expandable to transfer data types XML, JSON, TEST, CSV, Excel and serializable binary data streams

16. Next Steps ATO received April 17 √ Testing with partners May - June 2015 Replace existing EIP WS July 2015 2 nd EIP project implemented January 2016 Available for other CDC Programs

17. Questions