GUIDE · HEALTHCARE
Data off an isolated clinical workstation, without USB or the network
Many clinical and diagnostic devices come with a workstation that runs an operating system the vendor no longer updates. Connecting it to the hospital network lowers the whole network to its level; a USB stick carries patient data through an uncontrolled medium. Most teams end up with one of the two anyway.
Written by Taha Bayar, a biologist working on data handover between isolated systems.
Three routes that keep the workstation isolated
- Screen to camera. The workstation shows the file as encrypted codes; a phone or tablet reads them. Nothing is plugged in. Suits exports of kilobytes to a few megabytes.
- Printed pages. If the workstation has a printer but no camera, the file is printed as encrypted codes and read later by any camera. The printer queue only ever holds the codes.
- A one-way serial cable. For a fixed pairing with the PC that feeds the record system: a cable with only the transmit line connected, so nothing can travel back. Up to about 80 KB/s. Wiring and limits.
What stays true on every route
- No third party sees the data. The file goes from one device to the other; Kionel's servers never receive it, so the transfer adds no processor to your data-protection records.
- Each file has a signed record. With a business licence, the sending device signs the file's SHA-256 with the reference you enter (an order or accession number, for example), and the receiving device signs its delivery. Anyone can check both offline.
- The workstation needs only a browser. The offline package is a single HTML file with a published SHA-256, for a PC that never goes online.
Where it does not fit
- Kionel is not a medical device. It is not for diagnosis, treatment or clinical decisions, and it must not be the only channel for anything urgent.
- It needs a browser on the workstation. Embedded devices without one are out of reach; so are workstations whose browser is older than Chrome or Edge 137.
- It does not scan file content, and it has not had an independent security audit yet. The limits page lists the rest.