Linking to Internal Systems

This guide walks you through connecting the Revenue Recovery platform to your internal EHR systems. The connection process requires both a deployed Relay Service and proper configuration within the Revenue Recovery console.

Prerequisites: Before following this guide, ensure you have completed the Relay Service Deployment and have administrator access to the Revenue Recovery platform.

Supported EHR Systems

Current MVP Support

The Revenue Recovery platform currently supports the following EHR systems:

Important: At launch, only NextGen EHR systems are supported. Epic support is planned for a future release.

Connection Architecture

All EHR connections use the secure Relay Service architecture:

flowchart LR
    A[NextGen Database] --> B[Relay VM] --> C[Revenue Recovery Platform]

Connection Prerequisites

Before establishing a connection to your EHR system, ensure the following prerequisites are met:

Relay Service Requirements

Database Access Requirements

Your NextGen database must be configured with:

• SQL Server Authentication enabled (recommended)
• Dedicated service account with read permissions to NextGen tables
• Network connectivity from Relay VM to SQL Server (port 1433)
• Firewall rules allowing Relay VM → SQL Server communication
• Database name and schema (typically dbo schema)

Required Permissions

The connecting user must have:

• Administrator role in Revenue Recovery platform
• Database credentials for the NextGen SQL Server
• Network access to both the Revenue Recovery console and internal systems

Note: Each organization in the Revenue Recovery platform has a one-to-one relationship with an EHR connection. If the same NextGen instance manages multiple organizations, you can create multiple organizations that use the same connection configuration.

Step-by-Step Connection Process

Step 1: Access Connection Configuration

1. Log into the Revenue Recovery platform as an Administrator
2. Navigate to EHR Connection from the main navigation
3. Click Create Organization to start the process

Step 2: Select EHR System Type

1. Enter the Organization Name for your hospital or healthcare facility
2. Configure Transfer Frequency and Start Time as needed
3. From the EHR System Vendor dropdown, select NextGen

Step 3: Configure Database Connection

After completing the organization details, click Next to proceed to the database connection step. Enter the following database connection details:

Step 4: Authentication Setup

The platform uses SQL Server Authentication by default. The database connection form includes:

1. Username: Enter the SQL Server service account username
2. Password: Enter the secure password for the service account
3. Test Connection: Click to verify the connection settings

Note: The application currently supports SQL Server Authentication. Ensure your NextGen database is configured to allow SQL Server authentication and that you have appropriate service account credentials.

Step 5: Relay Service Configuration

The Relay Service configuration is handled automatically as part of the organization setup process. The platform will:

1. Connect to your pre-deployed Relay VM automatically
2. Verify the relay status during the connection test
3. Use the relay for secure database connectivity

Important: Ensure your Relay Service VM is deployed and registered before starting the EHR connection process. Refer to the Relay Service Deployment guide if needed.

Step 6: Connection Testing

1. Click Test Connection to validate all settings
2. The system will verify:
   • Database server connectivity
   • Authentication credentials
   • SQL query execution
   • Network connectivity through Relay Service

The connection test will provide immediate feedback on any configuration issues. Address any errors before proceeding to the final step.

Step 7: Save and Activate

1. Review all configuration settings
2. Click Next to proceed to the confirmation step
3. Review the summary and click Complete Setup to finalize
4. The organization and EHR connection will be created and activated automatically

Authentication Options

SQL Server Authentication

Best Practice: Create a dedicated service account with minimal required permissions.

-- Example SQL Server setup (run by DBA)
-- Use a strong, randomly generated password that meets your organization's complexity requirements.
-- Example password below is for demonstration only. Do NOT use in production.
CREATE LOGIN [ailevate_service] WITH PASSWORD = 'N4v!r7Qp$2sLw8zB@1eX';
CREATE USER [ailevate_service] FOR LOGIN [ailevate_service];

-- Grant minimal read permissions
GRANT SELECT ON SCHEMA::dbo TO [ailevate_service];
GRANT EXECUTE ON SCHEMA::dbo TO [ailevate_service];

Required Permissions:

• SELECT on NextGen patient and billing tables
• EXECUTE on approved stored procedures (if needed)
• CONNECT to the NextGen database
• Access to specific NextGen tables for claim processing

Windows Authentication

When using Windows Authentication:

1. The service account must be a domain account
2. The Relay VM must be domain-joined
3. Kerberos authentication must be configured
4. Use the format: DOMAIN\username

Connection String Security

All connection strings are:

• Encrypted at rest using AES-256
• Encrypted in transit using TLS 1.2+
• Rotated regularly per security policies
• Audited for access patterns

Troubleshooting Common Issues

Issue 1: "Connection Timeout" Error

Symptoms:

Error: Connection timeout after 30 seconds
Unable to reach SQL Server through Relay

Root Causes & Solutions:

Diagnostic Steps:

1. SSH to Relay VM and test connectivity:
   Bash

   telnet nextgen-sql.hospital.local 1433
   # or test with netcat
   nc -vz nextgen-sql.hospital.local 1433

2. Check SQL Server error logs for connection attempts
3. Verify firewall rules on both Relay VM and SQL Server
4. Test DNS resolution from Relay VM:
   Bash

   nslookup nextgen-sql.hospital.local

5. Verify Relay service status:
   Bash

   sudo systemctl status ailevate-tunnel.service
   sudo systemctl status ailevate-proxy.service

Issue 2: "Authentication Failed" Error

Symptoms:

Error: Login failed for user 'ailevate_service'
Authentication method not supported

Root Causes & Solutions:

Diagnostic Steps:

1. Test credentials directly on SQL Server:
   SQL

   -- Run on SQL Server
   SELECT name, is_disabled FROM sys.sql_logins 
   WHERE name = 'ailevate_service';

2. Verify SQL Server authentication mode
3. Check SQL Server error log for specific authentication errors
4. Test connection from SQL Server Management Studio using same credentials

Issue 3: "Relay Service Unavailable" Error

Symptoms:

Error: Relay Service not responding
Unable to establish secure tunnel

Root Causes & Solutions:

Diagnostic Steps:

1. Check Azure Arc agent status:
   Bash

   sudo azcmagent show

2. Test outbound connectivity:
   Bash

   curl -I https://management.azure.com

3. Review Azure Arc agent logs:
   Bash

   sudo journalctl -u azconnectedmachine -f

4. Check Relay service logs:
   Bash

   sudo journalctl -u ailevate-tunnel.service -n 50
   sudo journalctl -u ailevate-proxy.service -n 50

Connection Monitoring

Health Checks

The platform automatically monitors connection health:

• Connection Status: Real-time connectivity status
• Query Performance: Response time metrics
• Error Rates: Failed query percentages
• Data Freshness: Last successful data retrieval

Alerts and Notifications

Configure alerts for:

• Connection failures lasting > 5 minutes
• Query response times > 10 seconds
• Authentication failures
• Relay Service disconnections

Best Practices

1. Regular Testing: Schedule monthly connection tests
2. Credential Rotation: Rotate passwords quarterly
3. Monitoring: Review connection logs weekly
4. Documentation: Keep connection details updated
5. Backup Plans: Have fallback procedures documented

Next Steps: Once your EHR connection is established, proceed to Configuring Default Settings to customize how the platform interacts with your EHR data.