World-class Hosting Services

t H e m e r g e e c l i n i c a l a d va n ta g eMerge eClinical’s application hosting services go beyond standard hosting by providing a holistic solution to essential business continuity, resiliency and security. Merge eClinical has invested heavily to help you attain the peak performance your trials need to always be running quickly, efficiently and in a security-rich and industry-compliant environment.

Recognizing your critical need to access trial data at any time and in virtually any location around the world, Merge eClinical has assembled a highly talented team of IT professionals. Having successfully implemented more than a thousand trials, you can rely on our proven experience and certified technical knowledge to support your trial environments.

Managed by Peak10, a recognized leader in IT site services, our data center facility is able to ensure the network is highly available, reliable, redundant and secure. The data center is fitted with the latest hardware and software platform technology, disaster recovery and is configured for scalability. Merge eClinical manages your eClinical platform and applications to ensure consistent and reliable performance, while maintaining operations under virtually any condition.

H o S t i n g i n f r a S t r u c t u r eMerge eClinical houses study data in a secure, state-of-the-art hosting center and includes:• Superior service level agreements• High-performance connectivity• Redundant network and disaster recovery measures for high availability• A rich set of security services

Service Level GuaranteeMerge eClinical provides a Service Level guarantee that the system will be available to users in excess of 99% of the time. Due to the nature of most client activities, it is understood that the system often needs to be operational outside of regular business hours. The production server environment does not require system shutdown for daily data back-up, and with the exception of short periods for scheduled maintenance (conducted overnight on weekends) the system will be available on a 24/7 basis.

Data ProtectionContinuous data protection is achieved with a powerful EMC SAN. Advanced storage capabilities include simple management tools, continuous data availability and integrity, high performance data mobility and scalability. Additionally, Merge eClinical utilizes local replication for backup/restore and remote replication for disaster recovery and data mobility.

merge eclinical’s highly robust hosting services help ensure:

• Trial downtime is mitigated with state-of-the-art disaster recovery systems

• Critical systems, IT processes and networks are highly available

• Service levels are guaranteed across applications and operating environments

• Business risk is greatly reduced due to unanticipated events

Wo r l d - C l a s s H o s t i n g S e r v i c e

synchronized intelligence

trialintelligence

siteintelligence

patientintelligence

S e c u r i t yPhysical securityProduction & disaster recovery data centersThe data center restricts and monitors access using the following methods:

• 24/7 onsite security personnel• Client security escort• Electronic motion detectors• Continuous video camera surveillance• Unified security breach alarm with

access monitoring• Biometric fingerprint scan identification system

• Proximity card access throughout the facility • Access is restricted to authorized personnel • There is a fire suppression system in place• Reinforced exterior and interior walls• Raised floors for secure cable routing• Temperature and water sensors

• Access is restricted to authorized personnel • Proximity card access throughout the facility• Motion detection system• Defcon Halogen units located in secured areas• 24/7/365 badge access monitoring system

• Break glass monitoring system• 24/7/365 badge access monitoring system• Fire suppression system • Master key access for only senior management

team members

Merge eClinical headquartersThe following are high level security features at the physical location of our headquarters office:

Network Security• Redundant firewalls with IPS (Intrusion

Prevention Systems), protecting the infrastructure from internal or external attacks

• Data transfer between clients and Merge eClinical is over the Internet, operating on secure port https

• Firewall controls inbound and outbound access to Merge eClinical equipment and is only enabled through designated ports

• Hardened router configurations• Anti-virus protection• Secure File Transfers via public SSH server

• State-of-the-art VPN connection between our wireless ISP and the production network provides secure data transmissions between our diary devices and the servers

• Secure SSL/TSL encryption at the mail gateway

• Security-rich process for managing account generation, maintenance and termination for maintenance, as well as user accounts

• Administrative access to Merge eClinical systems are limited and based on group membership

Host Security• Patches are applied to Merge eClinical

systems as available and after thorough assessment

• Administrative access to Merge eClinical systems is limited and based on group membership

• Merge eClinical systems are administered remotely

• Utilization of Windows® terminal services client

• System access logs are local to the systems• Access limited to certain IP address ranges • All privileged use is logged • Security-related events are logged and

reviewed daily, including: o User login failures o Failure to obtain privileged access o Access policy violations o Administration events o Access policy modifications

Antivirus Policy• McAfee® Virus Scan Enterprise anti-virus solution • All devices placed on the network system are patched prior to initial connection• Virus definitions are updated daily via automatic updates

Incident response policy Internal employees are trained on procedures for reporting security incidents

a r c H i t e c t u r eNetworkMerge eClinical has invested more than $1M U.S in its new network infrastructure. High availability is achieved through the use of redundant firewalls at the network gateway and high-end core switches internally. Network security is enhanced by the use of an IPS at the network gateway.

Production Application/DatabaseMerge eClinical utilizes a three-tier high availability design for its application and database hosting: • Tier one are the application servers, which utilize blade servers

for their compact design, speed, and ease of expansion.• Tier two is a database cluster which provides high availability and

scalability of the database.• Tier three is a SAN (Storage Area Network) which houses the

databases and provides speed, high availability, scalability, redundancy and security.

r e l i a b i l i t yServer HardwareMerge eClinical uses only high-end IBM and Dell servers to host all client applications. Servers achieve full redundancy with redundant power supplies, processors, network connections, mirrored operating system drives and RAID-5 data storage.

Data CenterThe following are reliability features of the physical data center:

4

Reliability

Server hardware etrials uses only high-end IBM and Dell servers to host all client applications. Servers achieve full redundancy with redundant power supplies, processors, network connections, mirrored operating system drives and RAID-5 data storage.

Data center The following are reliability features of the physical data center:

Redundant air conditioning systems Raised floor designed for efficient cooling Static transfer switches and fully redundant UPS Backup diesel generator State-of-the-art network operations center Certified technical staff onsite 24/7 Redundant and diverse fiber entrances Multi-homed Internet backbone with DS-3, OC-3 and Gigabit Ethernet

connections using BGP-4 routing protocol

4

Reliability

Server hardware etrials uses only high-end IBM and Dell servers to host all client applications. Servers achieve full redundancy with redundant power supplies, processors, network connections, mirrored operating system drives and RAID-5 data storage.

Data center The following are reliability features of the physical data center:

Redundant air conditioning systems Raised floor designed for efficient cooling Static transfer switches and fully redundant UPS Backup diesel generator State-of-the-art network operations center Certified technical staff onsite 24/7 Redundant and diverse fiber entrances Multi-homed Internet backbone with DS-3, OC-3 and Gigabit Ethernet

connections using BGP-4 routing protocol

• Redundant air conditioning systems• Raised floor designed for efficient cooling • Backup diesel generator • Static transfer switches and fully

redundant UPS • State-of-the-art network operations center

• Certified technical staff onsite 24/7 • Redundant and diverse fiber entrances • Multi-homed Internet backbone with DS-3,

OC-3 and Gigabit Ethernet connections using BGP-4 routing protocol

t e l e c o m m u n i c at i o n SMerge eClinical telecommunications vendors are required to maintain redundant systems in the event of a failure.

Advanced Phone SystemMerge eClinical uses an IP phone system that enables locations to be connected 24/7/365. The phone system can be used as a disaster recovery process when phones are programmed in the teleworker mode in the event of an emergency.

Automatic Call Dialer (ACD) SystemThe Merge eClinical ACD system is state-of-the-art and enables our helpdesk staff to quickly, efficiently and knowledgably aid in the handling of any issues that may occur while assisting our clients. Report generation can be obtained through this system for all calls entering the ACD network.

Fax ServerMerge eClinical uses a robust fax server for all external/internal faxing.

S ta n d a r d o p e r at i n g p r o c e d u r e SMerge eClinical follows a very detailed set of operating procedures to ensure the security and confidentiality of information. The procedures also identify hiring and training methods, project design and control, quality control and customer support.

Call today 866.387.4257 or visit www.merge.com/eclinicalMerge Healthcare utilizes decades of technology, expertise, intellectual property, innovative software development and expert services to build IT solutions for healthcare and biopharmaceutical customers worldwide. We bring a customer-driven enthusiasm that assures etrials Service Delivery remains relevant to your business goals, now and into the future. Copyright 2009 Merge Healthcare Incorporated.