Go live
Take a EDFlow integration live: sandbox conformance, the customer-test shadow run and the 98% milestone agreement gate, promotion with four-eyes approval and the PIA attestation, cut-over, and monitoring after go-live.
An integration moves sandbox → customer test → live. Nothing is copied between environments: you create a separate app in each, and the portal's Promote checklist records the evidence.
The checklist
Sandbox conformance
Run the conformance profiles your integration needs: ingest (every event type you declare, idempotent retries, out-of-order delivery, a prohibited-field rejection, heartbeat and roster), webhooks, writeback, and the operational profiles outage_recovery, clock_skew and backfill_10k. See Sandbox.
Customer-test shadow run
Send the hospital's test-domain feed through customer test for at least 5 days. Check your engine's ACK handling against the ACK table: no queue holds on EDFlow ACKs.
Mapping reviewed
The mapping profile diff is reviewed and there are zero unmapped codes over the last 7 customer-test days.
Webhook receiver verified
The delivery log shows your receiver verifying signatures, deduplicating a redelivery, dropping an expired event and, if configured, authenticating EDFlow with OAuth or mTLS.
PIA attestation
For sensitive scopes (encounters:read, careteam:read, requests:read, requests:write, tasks:read), the organization's privacy officer records the PIA/TRA section in the system, referencing the signed document.
Live app approved
Create the live app with the same scopes or fewer. An approver who didn't create or submit it approves it, and a developer who isn't the approver reveals the credentials.
The site's go-live gates
The integration gates join the site's gates:
- a 14-day shadow run with at least 98% milestone agreement against the site's audit sample;
- p95 EHR-to-screen latency of 60 s or less;
- rejected events below 0.5%;
- zero unmapped codes in the last 30 days;
- roster reconciliation closing every test discharge;
- the clinical safety case, PIA and TRA signed off, staff trained.
Cut-over
- Send the current ED census as
mode: "backfill"events (arrival, triage, location, current team). Backfill never notifies anyone. - Start the live feed, the 60-second heartbeat and the 15-minute roster.
- Watch the integration health page: feed state, events per minute, rejections by code, roster discrepancies.
After go-live
- Alerts: feed delayed and down, dead letters, quarantined rosters and credential expiry reach the integration on-call and your webhook endpoints (
feed.state_changed,ingest.dead_lettered,ingest.roster_quarantined,integration.credential_expiring). - Data issues reported by staff land on the integration health page. See Data issues.
- Changes: test engine changes in customer test first. Rotate credentials before they expire.
Related
Dernière mise à jour le
Cette page vous a-t-elle été utile?
Versioning and deprecation
How the EDFlow API and event contract are versioned: the URL major version, dated Api-Version pins, specVersion, notice periods for new enum values and event types (60 days) and breaking changes (12 months), Deprecation and Sunset headers, and host migration.
API changelog
Changes to the EDFlow Integration API and event contract: dated API versions, additive releases, announced enum values and event types, deprecations and sunsets.