Clinic IT Security: Zero-Port Firewall Setup for CMS Data Synchronization

Overview for Clinic IT & Network Administrators

Traditional clinic synchronizers are a cybersecurity nightmare for healthcare IT departments. They frequently require:

• Installing unverified Windows .exe or .bat background services.
• Opening inbound database ports (e.g. MySQL port 3306 or MS SQL port 1433) to the public internet.
• Setting up complex dynamic DNS, port forwarding, or site-to-site VPN tunnels.

LamaniSync eliminates 100% of these attack vectors.

---

The 0 Inbound Open Ports Guarantee

LamaniSync operates strictly as an Outbound-Only Workstation Bridge:

Clinic Internal Network                     Public Internet              LamaniHub Cloud
┌───────────────────────────────┐           ┌──────────────┐             ┌─────────────────┐
│ Front-Desk PC (LamaniSync)    │ ────────> │ NAT Firewall │ ──────────> │ WSS TLS 1.3     │
│ Port: Dynamic Outbound Client │  OUTBOUND │ (0 INBOUND   │  PORT 443   │ *.lamanihub.com │
│                              │   TRAFFIC │  PORTS OPEN) │             │                 │
└───────────────────────────────┘           └──────────────┘             └─────────────────┘
                                                   ▲
                                                   │
                                     BLOCKED: All Inbound Connections

• 0 Inbound Ports: The workstation never listens on any local port. Incoming probes from external networks are dropped by default.
• Port 443 Only: All traffic traverses standard HTTPS/WSS (Port 443) using modern TLS 1.3 encryption.
• Zero Inbound NAT / Port Forwarding: Clinic routers require zero special configuration or DMZ setups.

---

IT Firewall Whitelist Rules

If your clinic network enforces strict outbound URL filtering, add the following endpoints to your firewall allowlist:

---

The Zero-Disk & Zero-PHI Guarantee

To satisfy strict healthcare privacy standards:

1. Pure Ephemeral RAM Execution: LamaniSync runs strictly inside Chrome's sandboxed worker memory. It never writes appointment details, patient names, IC/NRIC numbers, or medical notes to local disk.
2. Zero chrome.storage.local for PHI: The extension uses browser storage exclusively for pairing tokens and public keys. Patient health information is processed in-flight and discarded immediately following readback verification.
3. No Password Storing: LamaniSync operates inside the authenticated browser session established by your front-desk staff. It never requests, captures, or transmits CMS passwords to any server.

---

Regulatory Compliance Matrix