Provider Manual · Part IX

Office devices (Hero Connect)

Hero Connect is one small Windows program on one computer in your office. It sends results from your lab machines, images from your X-ray machine and files other machines export straight to Hero, and you set it up and look after it from Admin → Office devices.

10 sections~28 min read
IX
Part IX · continued

Office devices (Hero Connect)

Hero Connect is one small Windows program on one computer in your office. It sends results from your lab machines, images from your X-ray machine and files other machines export straight to Hero, and you set it up and look after it from Admin → Office devices.

9.17Hero Connect

Connect your office’s devices with Hero Connect

Hero Connect is one small Windows program for one computer in your office. It sends results from your lab machines, images from your X-ray machine and files other machines save to a folder straight to Hero. You install it with one command and set up everything else from Admin → Office devices, in the Practice group of the Admin menu.

DeviceWhat Hero Connect doesWhere it lands in Hero
Lab machine: GeneXpert Xpress, LIAISON NES, or another machine that sends ASTM or HL7Listens on a port for the machine’s results and sends each one to Hero.The patient’s Labs tab, or Lab machines → Need a chart (see Lab machines).
X-ray machine (DICOM), or an ECG machine that sends DICOM over the network, such as the Welch Allyn CP 150Installs and runs a DICOM receiver (Orthanc) that the machine sends its images or tracings to, and can send the day’s X-ray exams to an X-ray machine as a worklist.The device inbox (the DICOM dashboard’s Inbox tab), where images and ECGs are filed to the chart.
Folder of exported files: an ECG computer, a bone density machine or any machine that saves DICOM images or PDF reports to a folderWatches the folder and sends each new file once.The device inbox (the ECG inbox or the DICOM dashboard’s Inbox tab).
  • It runs in the background. Hero Connect starts with Windows, keeps working when nobody is signed in, and restarts itself if it stops. No browser has to stay open.
  • It only connects out. It talks to Hero over HTTPS, the way a browser does. Nothing on the internet connects in, and your router needs no changes. Only machines on your office network can reach it.
  • You set it up in Hero. Devices are added and changed in Office devices; the computer picks the changes up by itself, usually within a minute.
  • It looks after itself. It updates itself when Hero releases a new version, and goes back to the previous version on its own if a new one fails to start.
  • It waits out internet outages. While the internet or Hero is down, results, images and files wait on the computer, and they go to Hero once the connection is back.

What the computer needs

  • Windows 10 or Windows 11 (Windows Server works too), on the same office network as the devices it serves. Hero Connect uses the Windows PowerShell built into Windows; there is nothing else to install.
  • On during clinic, and set never to sleep while plugged in. Hero Connect can’t receive anything while the computer is off or asleep.
  • A fixed network address, so the machines can always find it. Ask whoever looks after your office network or router to reserve its address.
  • Internet access, and a network that Windows treats as Private (see Network & firewall).
  • A Windows administrator account, once, to paste the install command.
  • Windows 11 (or Windows Server 2022 or later) for the LIAISON NES’s secure connection.
  • Free disk space for an X-ray or ECG machine: the DICOM receiver is a download of about 200 MB the first time, and images are kept on the computer for a week after Hero has them. A check warns when less than 5 GB is free.

One computer can serve all your devices (up to 64). If your machines are in different places, you can add more than one computer.

To see which popular lab analyzers, X-ray, ultrasound, ECG and other machines send results this way, see Lab, X-ray & ECG integrations.

Who can set it up. Office devices is for practice administrators, owners and office managers, and for staff given the permission Set up Hero Connect computers and office devices. A physician needs an administrator role for it. Anyone else who opens it sees Ask your practice administrator to set up office devices. Working the results that arrive is a separate permission (see Lab machines).
9.18Add a computer

Add a computer: a pairing code and one command

Each computer is added once, with a one-time pairing code and one command pasted into Windows PowerShell. There are no files to download. The easiest way is to open Hero on that computer itself, so you can copy the command there.

  1. Open Admin → Office devices and click Add a computer. Before any computer is added, the page explains what Hero Connect is and shows the button in the middle.
  2. Name the computer, if you like, and click Get a code. Name for this computer is optional, for example Front desk PC; you can change it later with Rename. Hero shows the Pairing code, the command, and Code expires in with a countdown. The code works once, for 15 minutes.
  3. Open Windows PowerShell as administrator on the office computer. Use the computer that is on the same network as your lab machines or X-ray machine and stays on during clinic. Click Start, type PowerShell, right-click Windows PowerShell and choose Run as administrator.
  4. Paste the command and press Enter. Click Copy next to the command in Hero, then paste it into the PowerShell window (right-click, or Ctrl+V). Leave the window open until it says it’s finished. It shows Hero Connect is connected to … as …, where it was installed, This computer’s address: … and, last, Hero will finish setting up your devices from Hero. You can close this window.
  5. Add its devices. Hero shows Connected: … with the computer’s name and Next, add the lab machines, X-ray machine or folders this computer serves. Click Add a device (see lab machines, X-ray machines and folders).

If the 15 minutes run out first, Hero shows This code has expired. Click Get a new code and paste the new command on the computer. Each code adds a new computer, so to move Hero Connect to another computer, add the new one and its devices, then remove the old one (see Remove a computer).

If the PowerShell window shows a message

The window saysWhat to do
Please run this as administrator: right-click Windows PowerShell, choose “Run as administrator”, and paste the command again.Close the window and open Windows PowerShell with Run as administrator.
That pairing code didn’t work. It may have been used already or be more than 15 minutes old. …Get a new code in Hero and paste the new command.
This computer couldn’t reach Hero. Check that it’s connected to the internet, then paste the command again.Check the computer’s internet connection. If your office filters outgoing traffic, see Network & firewall.
Too many tries. Wait 15 minutes, then make a new code in Hero and paste the new command.Wait 15 minutes, then get a new code.
Windows treats this computer’s network as Public, so office machines can’t reach it. In Windows Settings, set this network to Private.Hero Connect is installed, but set the network to Private (see Network & firewall).
Hero Connect is installed but hasn’t reached Hero yet. It will keep trying. …It keeps trying by itself. When it gets through, its card in Office devices shows Online.
Hero Connect is still running and couldn’t be stopped. Restart this computer, then paste the command again.Restart Windows, then paste the command again (get a new code if 15 minutes have passed).
9.19The computer card

Read a computer’s card

Each computer has a card in Office devices. Times are in your practice’s time zone; hold the pointer over a time to see it exactly.

  • The top shows the computer’s name, its Windows name and Address …: the address you enter on lab machines and X-ray machines. A computer that has just been added says Waiting for its first report.
  • Online or Offline, with Last seen. The computer checks in with Hero about every 30 seconds, and the card shows Offline once it has missed a few check-ins.
  • Hero Connect and the version it runs, with Update available when Hero has a newer one, and Saving changes to the computer… while it picks up a change you made.
  • The latest check: Checked 2:40 PM: everything is working., or how many things need attention with a line for each. Before the first check it says No check has run yet. See Run a check.
  • The buttons Run a check, Restart, Update now, Add a device, Rename and Remove computer.
  • Devices: one row for each device, with its status, Last result (Last image for an X-ray machine, Last file for a folder) and how many arrived today, how many are waiting to send, and the buttons Test, What to enter on the machine and Edit.
  • Activity: click it to see each check, test, restart, update and removal, who asked for it ((Hero support) when Hero’s team did), when, and how it went.

A device’s status

StatusWhat it means
ReadyWorking. The line beside it says how, for example Listening on port 5150, Ready for the machine on port 4242, AE title HERO. or Watching the folder.
StartingHero Connect is starting it, for example after a change of settings (Starting on port 5150).
Setting upHero Connect is still installing what the device needs, such as the DICOM receiver for an X-ray or ECG machine the first time.
Needs attentionSomething is wrong; the line beside it says what (see Troubleshooting).
OffTurned off in Hero. Someone unticked On in the device’s Edit.
Not reportingThe computer is offline.
Waiting for the computerThe computer hasn’t reported on this device yet, for example just after you added it.
9.20Add a lab machine

Add a lab machine

  1. Click Add a device on the computer’s card. Under What is it?, choose GeneXpert Xpress, LIAISON NES or Other lab machine.
  2. Give it a name. Name is what staff see in Hero, for example Front desk GeneXpert.
  3. For another lab machine, choose its connection. Under The machine’s settings call its connection, pick the word the machine’s LIS or host settings use: ASTM or HL7. This can’t be changed later: To change this, remove the machine and add it again.
  4. Keep or change the port. Port is where the machine sends its results on this computer. Leave it empty to use the default in the table below, or the next free port when another device already has it. A port must be from 1024 to 65535, can’t be 4242 (4242 is Hero’s X-ray port. Choose another port.) and can’t be one another device on this computer uses.
  5. Leave Secure connection as it is, unless the computer runs Windows 10. It is offered for HL7 machines only, and called TLS on the machine. It is on by default for the LIAISON NES; on Windows 10, untick it (see Machine settings).
  6. Optionally, limit who can send. Under More settings, Only accept results from these addresses takes the machine’s own address, for example 192.168.1.50 (several separated by commas, up to 16). Leave it empty to accept any machine on this office network.
  7. Click Add device, then enter the settings on the machine. Hero shows What to enter on the machine with this computer’s address and the port. The machine-by-machine steps are in Machine settings, and what staff enter for each patient is in Chart number & filing.
ChoiceConnectionDefault portSecure connection
GeneXpert XpressASTM5150Not offered
LIAISON NESHL75151On
Other lab machine, ASTMASTM5152Not offered
Other lab machine, HL7HL75153Off; can be turned on

Edit on the machine’s row changes its name, port, secure connection and allowed addresses, or turns it off: untick On (Turn off to stop Hero Connect from serving it without removing it.). If you change the port, change it on the machine too. Remove in the same window asks Remove … from …? Hero Connect stops listening for it. Results it already sent stay in Hero. If someone else changed the device while you were editing, Hero offers Load the latest settings and keeps your changes on top of them.

9.21Add an X-ray or ECG machine

Add an X-ray machine, with its worklist, or an ECG machine that sends DICOM

Hero Connect installs and runs the DICOM receiver (Orthanc) for you, including the Microsoft Visual C++ runtime it needs. You don’t install anything on the computer yourself. An ECG machine that sends its tracings over the network, such as the Welch Allyn CP 150, uses the same receiver (see An ECG machine that sends DICOM below).

First turn on imaging for the practice. X-ray images go to Hero’s device inbox, so Enable ECG and imaging uploads and Enable the ECG device inbox must be on, under Admin → ECG / DICOM devices or in the DICOM dashboard’s Setup (ECG and imaging uploads and Device inbox). Until they are, Add device says Turn on X-ray and imaging (DICOM) in Additional Features first. or Turn on DICOM and its Device inbox in DICOM > Setup first.
  1. Click Add a device and choose X-ray machine.
  2. Enter the X-ray machine’s own details, from its DICOM or network settings: X-ray machine’s AE title (for example XRAY1; up to 16 capital letters, numbers, - or _), X-ray machine’s address (for example 192.168.1.50) and X-ray machine’s port (usually 104).
  3. Keep Send the day’s X-ray exams to the machine ticked if you want the worklist: The machine’s worklist then lists each patient, so nobody retypes them. See below.
  4. Leave Hero’s own details as they are, unless your vendor asks otherwise. Under More settings, Hero’s AE title is what the X-ray machine calls Hero (HERO unless you change it), and Hero’s port is where the machine sends images. Left empty, Hero picks a free port: 4242 unless another device on this computer uses it. Each X-ray machine on a computer has its own port.
  5. Click Add device, then enter the settings on the X-ray machine. What to enter on the machine says to add two DICOM nodes on the X-ray machine, both pointing at this computer’s address with Hero’s AE title and port: a Worklist (MWL / “RIS”) server and a Storage (PACS / “Send to”) destination, with automatic send after the exam if the software offers it. Without the worklist there is one node, for storage. Then use the machine’s Echo or Verify button to check each one. If you can’t find these settings, ask the X-ray machine’s vendor to add Hero as a DICOM worklist and storage destination.
  6. Wait for Ready. The first X-ray or ECG machine on a computer downloads the DICOM receiver, about 200 MB, so it can take a few minutes. Meanwhile the row shows Setting up with what is happening: Downloading the DICOM receiver (Orthanc, about 200 MB)., Installing the DICOM receiver (Orthanc). This takes a few minutes., Installing the Microsoft Visual C++ runtime that the DICOM receiver needs. and Starting the DICOM receiver. Then it reads Ready for the machine on port 4242, AE title HERO.
  7. Click Test. It checks that the receiver is installed and running, that it is listening for the machine, that the office network can reach this computer, that the machine answers a connection test and, with the worklist on, that Hero Connect has today’s worklist. If the machine doesn’t answer, the test says The machine (…) didn’t answer. Check that it’s on and that its network settings match. A machine that only sends never answers: tick This machine only sends in its Edit.

Each image the X-ray machine sends goes to the device inbox, where staff file it to the chart. With the worklist on (below), an image taken from a worklist exam files itself, and so does an exact chart-number match when Automatically file exact chart-number matches is on. The receiver keeps its own copy on the computer for 7 days after Hero has the image.

An ECG machine that sends DICOM (such as the Welch Allyn CP 150)

Some ECG machines, such as the Welch Allyn CP 150, send each tracing over the network in DICOM instead of saving files. They only send: they never answer a connection test from Hero Connect. (For an ECG machine that saves files to a computer instead, see Add a folder of exported files.)

  1. Click Add a device and choose ECG machine that sends DICOM (like the CP 150). This machine only sends is ticked, so Test doesn’t call the machine, and there is no worklist.
  2. Enter the ECG machine’s AE title and address from its DICOM or network settings, for example CP150 and 192.168.1.60. Hero accepts tracings only from that AE title (and that address, when it is written as numbers), so give the machine a fixed address.
  3. Click Add device, then enter the settings on the ECG machine. What to enter on the machine says to add a storage destination (sometimes called a DICOM server or “Send to”) pointing at this computer’s address with Hero’s AE title and port, and to turn on sending each test automatically if the machine offers it. If you can’t find these settings, ask the machine’s vendor to turn on DICOM output to a storage destination.
  4. Wait for Ready, click Test, then record a test ECG. Test checks the receiver, the port and the office network. The test tracing then waits in the device inbox, shown as an ECG, to be filed to the chart.

The worklist

The worklist is the list of today’s exams on the X-ray machine, so the technologist picks the patient instead of typing them in. It needs the DICOM dashboard turned on (Admin → Additional Features). Turn on Send the schedule to the X-ray machine in the dashboard’s Setup too: images taken from a worklist exam then file themselves. The exams come from the dashboard’s Worklist tab: Add everyone on this day’s schedule, Walk-in exam, or an exam added for one appointment. Hero Connect fetches today’s exams every minute and puts them on the X-ray machine’s worklist. The Worklist tab says Hero Connect sends these exams to the X-ray machine once it’s set up in Admin > Office devices.

Moving from the older Chrome connection. The DICOM dashboard’s Setup, under Connect the X-ray machine, shows This computer is using the older Chrome connection. Switch to Hero Connect in Office devices. where Chrome still holds an export or worklist folder. Once Hero Connect shows the X-ray machine Ready, point the X-ray machine at Hero Connect as above and click Disconnect on those folders. Hero Connect uses only an Orthanc it installed itself: on a computer that already has Orthanc (for example one set up for the Chrome connection), the row reads This computer already has Orthanc installed for something else, so Hero Connect left it alone. Use another computer for this machine.
9.22Add a folder

Add a folder of exported files (ECG and other machines)

Use this for a machine whose software saves its results as files on a computer, such as an ECG or a bone density machine. Hero Connect watches the folder and sends each DICOM image or PDF report it finds to the device inbox, with no browser open. The folder must be on the Hero Connect computer itself, so install Hero Connect on the computer the machine saves to. As for an X-ray machine, the practice’s Enable ECG and imaging uploads and Enable the ECG device inbox must be on first (see Add an X-ray machine).

  1. Click Add a device and choose Folder of exported files (ECG, other machines).
  2. Enter the folder. Folder on this computer is the full path where the machine’s software saves its exports, starting with the drive letter, for example D:\ECG\Export. It must be on this computer’s own drives (Network folders can’t be used.), and it can’t be a whole drive, a system folder such as C:\Windows, a user’s profile folder itself, Hero Connect’s own folder, or a folder another device on this computer already uses.
  3. Choose what to send. Under Files to send, tick DICOM images, PDF reports or both. Tick Include folders inside it if the machine saves into subfolders.
  4. Click Add device. What to enter on the machine reminds you to set the machine’s software to save its exports to that folder. The row shows Watching the folder. once it is ready. Test checks that the folder is allowed, exists and can be read.

Hero Connect sends a file once it has stopped changing for a few seconds, and sends it again only if it changes. It never changes or deletes anything in the folder: the machine’s files stay where they are. In Hero, each file waits in the ECG inbox (or the DICOM dashboard’s Inbox tab) to be filed, as described in ECG & imaging files. Sending patient details to an ECG machine (Send to ECG) still uses the Chrome connection described there.

9.23Checks & updates

Run a check, test, restart, update or remove a computer

The buttons on a computer’s card send one fixed request to that computer. While it works on it the card says Waiting for the computer…, then how it went; Activity keeps the history. The buttons are off while the computer is offline (The computer is offline. Checks and tests are available again when it’s back online.). A request the computer never picks up fails after an hour with The computer wasn’t online, so this didn’t run.

ButtonWhat it doesWhat the card then says
Run a checkThe computer checks each device, its firewall rules, free disk space, its clock, whether Windows treats the network as Public, and the DICOM receiver.Checked …: everything is working. or how many things need attention, with a line for each. Details shows each device’s port, firewall rule and last connection; Log for Hero support is the program’s recent log.
Test (on a device’s row)Checks that one device, step by step (see each device type above).Each check with a tick or a cross and a line of explanation, then The test passed. or The test found a problem.
RestartRestarts Hero Connect on that computer. Windows itself doesn’t restart.Restarted.
Update nowInstalls Hero’s newest version now, instead of waiting for it to update itself.Updated from … to …. or Already up to date.
RenameOpens Rename computer: Staff see this name in Hero, with results and images it sends.The card shows the new name.
Remove computerUninstalls Hero Connect from that computer (below).Removed from the computer.

Updates

Hero Connect updates itself when Hero releases a new version; until it has, the card shows Update available. Each update is checked against what Hero says it should be before it is installed. If a new version doesn’t start, Hero Connect goes back to the version it had, by itself, and keeps working; Update now then says The update to version … didn’t start, so Hero Connect went back to version …. Devices keep their settings through every update.

Remove a computer

  • While it is online, Remove computer asks Remove Hero Connect from …? It uninstalls itself from that computer and stops sending from its devices. Anything it hasn’t sent yet stays on the computer. Click Remove.
  • While it is offline (or if removing didn’t finish), Hero offers to disconnect it instead: it stops working with Hero right away, and this can’t be undone. Click Disconnect. To remove the program later, run the command Hero shows on that computer, in Windows PowerShell as administrator. It needs no internet connection.

Either way, the computer’s card then leaves Office devices, and it can’t connect again with its old key. To use it again, add it as a new computer with a new code.

9.24Network & firewall

The office network, Windows Firewall and the “Public” network setting

  • Out to Hero only. Hero Connect connects out to Hero over HTTPS. Nothing on the internet connects in, so there is nothing to open on your router.
  • In from the office network only. For each lab machine and X-ray machine, Hero Connect adds a Windows Firewall rule for that device’s port, named Hero Connect (TCP …). The rule lets in only machines on the same local network, and only while Windows treats the network as Private or Domain. With Only accept results from these addresses filled in, it lets in only those addresses. Folders need no rule. If a rule goes missing, Hero Connect adds it again.
  • A fixed address. Machines send to the address shown on the computer’s card. If that address changes, every machine has to be changed, so have it reserved on your router.
If Windows treats the network as Public, machines can’t reach Hero Connect. The install window then says Windows treats this computer’s network as Public, so office machines can’t reach it. In Windows Settings, set this network to Private., a device’s Test fails its Network check, and Run a check lists Windows treats this computer’s network as Public, which blocks the machines from reaching it. Open Settings > Network & internet, choose your network’s Properties, set it to Private network, and click Test again.

Ports

DeviceDefault port on the Hero Connect computer
GeneXpert Xpress5150
LIAISON NES5151
Other lab machine, ASTM / HL75152 / 5153
X-ray machine4242 (a second X-ray machine on the same computer gets the next free port)
Folder of exported filesNone

Another firewall, antivirus or web filter

If your office uses a firewall or antivirus program besides Windows Firewall, ask whoever manages it to allow the ports above from the office network and the Hero Connect scheduled task. If outgoing internet traffic is filtered, the computer must be able to reach Hero over HTTPS and, for an X-ray machine, the Orthanc download site (orthanc.uclouvain.be) and Microsoft, for the Visual C++ runtime.

9.25Troubleshooting

Fix what a status or test says

Start with the device’s status line and its Test, then Run a check. If you contact Hero support, run a check first: Hero support can read it, and its log, from Hero.

The computer

You seeWhat to do
Offline, and devices Not reportingCheck that the computer is on, awake and on the internet. Restarting Windows starts Hero Connect again. To check it on the computer itself, open Windows PowerShell there (any Windows user can) and run powershell -ExecutionPolicy Bypass -File "C:\Program Files\Hero Connect\HeroConnect.ps1" -SelfTest. It lists whether Hero Connect is installed, connected, able to reach Hero and running, and ends with Result: ready or Result: needs attention (see above).
Only … GB of disk space left on the computer.Free up disk space on that computer.
The computer’s clock is about … minutes off.In Windows, turn on Set time automatically.
On the computer, the check says Hero has turned this computer off; ask your Hero admin.The computer was removed or disconnected in Hero. To use it again, add it as a new computer with Add a computer.

Lab machines

You seeWhat to do
Port … is in use by another program. Hero Connect will keep trying.Another program on the computer uses that port. Close or remove it, or click Edit, choose another port, and change it on the machine too.
This computer’s Windows can’t use the secure connection. Turn off ‘Secure connection’ for this device, or use a Windows 11 computer.See Machine settings: turn the secure connection off in Hero and TLS off on the machine.
… results are waiting to be sent to Hero.The computer can’t reach Hero right now. The results are safe on the computer and go to Hero by themselves once it can.
… result couldn’t be sent to Hero.Hero didn’t accept it. It is kept on the computer, and Hero Connect tries again every day and whenever the machine is changed in Hero. Contact Hero support if it stays.
Refused a connection from … because it isn’t an allowed address.Add the machine’s address under Only accept results from these addresses, or empty that box.
Hero Connect can’t save results on this computer’s disk right now. The machine will send them again.Free up disk space on the computer.
Test: No machine has connected yet.Check the host address and port on the machine against What to enter on the machine, and that the network is Private.

X-ray machines

You seeWhat to do
Hero Connect couldn’t download Orthanc. Check this computer’s internet connection. It will try again in 15 minutes. (or the same for the Microsoft Visual C++ runtime)Check the internet connection and any web filter (see Network & firewall). It tries again by itself.
This computer already has Orthanc installed for something else, so Hero Connect left it alone. Use another computer for this X-ray machine.Add the X-ray machine on another computer, or ask Hero support.
The DICOM receiver didn’t start. Another program may be using port …. Use Run a check and send the result to Hero support.Click Run a check and contact Hero support. Or click Edit and choose another Hero’s port, and change it on the X-ray or ECG machine too.
The DICOM receiver didn’t start with the new settings, so Hero Connect went back to the previous ones. Another program may be using port ….Choose another Hero’s port.
X-ray and imaging isn’t turned on for this practiceTurn on Enable ECG and imaging uploads and Enable the ECG device inbox. Images wait on the computer until then.
Couldn’t get today’s worklist from Hero. The X-ray machine shows the last list Hero Connect received.Check that the DICOM dashboard and Send the schedule to the X-ray machine are on, and the computer’s internet connection.
Test: The X-ray machine (…) didn’t answer. Check that it’s on and that its network settings match.Check the X-ray machine’s AE title, address and port in the device’s Edit against the machine’s own DICOM settings.
Some X-ray images couldn’t be saved for upload. Check this computer’s free disk space.Free up disk space on the computer.

Folders

You seeWhat to do
This computer can’t find the folder set for this device.Check the path in Edit, and that the drive is there.
This folder is on a network drive. Hero Connect can only watch folders on this computer’s own drives.Use a folder on this computer, or install Hero Connect on the computer that holds the folder.
This folder is a shortcut to another location. Set the device to the real folder.Enter the folder’s real path.
Hero Connect can’t read this folder.Ask whoever manages the computer to check the folder’s Windows permissions.
Files are waiting to upload because Hero can’t be reached. Hero Connect keeps trying.Nothing to do; they go to Hero once the computer can reach it.
Watching the folder. … files couldn’t be uploaded.Hero didn’t accept those files. Contact Hero support if it keeps happening.
9.26Security & patient data

How Hero Connect keeps the connection and patient data safe

  • Outbound only. Hero Connect only connects out to Hero, over HTTPS. Nothing on the internet can connect to it, and only machines on your office network can reach its ports.
  • Its own key. When the pairing code is used, Hero gives that computer its own key. The code works once, for 15 minutes. The key is kept on the computer protected by Windows, in a folder only the system and Windows administrators can open, and Hero keeps only a fingerprint of it. Disconnecting a computer turns its key off at once; removing one turns it off once Hero Connect has uninstalled itself.
  • Fixed requests only. From Hero, the computer accepts only a check, a device test, a restart, an update and removal. It never runs any other command.
  • Checked downloads. An update is installed only if it matches what Hero says it should be. The DICOM receiver it downloads must match the version Hero expects, and the Visual C++ runtime must carry Microsoft’s signature.
  • No patient data in what it reports. The computer’s status, checks, test results and log carry no patient names or chart numbers: only ports, counts, addresses, versions and plain status text, so the Run a check output and its log have no patient data. As a second safeguard, Hero removes anything that looks like a chart number, phone number, email or other identifier from that text before saving it. Hero’s answers to each upload carry no patient data either. The worklist is the exception: with it on, today’s X-ray exams, with each patient’s details, go to the computer so the X-ray machine can list them.
  • On the computer. Results not yet sent, and X-ray images for 7 days after Hero has them, are kept in Hero Connect’s own folder, which only the system and Windows administrators can open. They are patient information, so turn on BitLocker or Device encryption (Settings > Privacy & security) and lock the computer when no one is at it. Hero Connect never changes or deletes the files in a practice’s own export folders.
  • A record of changes. Hero records every change made in Office devices, and each upload from the computer, in its audit log. A computer’s Activity shows who asked for each check, test, restart, update and removal.

Need help? Email support@heroemr.com.