Duke Health Technology Solutions (DHTS) supplies the IT infrastructure, governance, and polices for all clinical and non-clinical applications used by the Duke School of Medicine and Duke University Health System. This includes hosting architecture, deployment, and environmental maintenance for all entity websites. DHTS Public Web Hosting is the primary technical contact group for the development cycle.
The Duke Health System provides hosting for sites developed in the Drupal framework. A central repository contains a well-maintained Drupal base code and supported modules. Vendors are expected to begin the development cycle using the DHTS existing code base.
There are many well-established content management platforms, and new ones being developed all the time. Duke evaluated more than a dozen platforms before settling on Drupal, which scored the highest marks as a platform for the following criteria:
- Strong core architecture
- Third-party application integration
- Suite of administration and monitoring tools
- Wide scale community support
- Enterprise level scaling
Drupal is the only vetted and approved content management system for Duke University Health System.
Without special dispensation all Duke Health sites must be hosted by DHTS. It is the policy of Duke Health Information Security that all intellectual property including, but not limited to, all domains that contain duke.edu remain within a Duke hosted environment, be monitored by specific security and productivity tools, and patched in accordance with Duke policy. Any entity seeking third-party hosting will have to provide the following:
- A business case for third-party hosting.
- A full security review to ensure compliance with Duke Health policies.
- An extended support agreement for the site(s) for the duration of hosting services.
- No sensitive electronic information of any kind.
- Vendor-signed Business Associate Agreement (BAA).
DHTS will:
- Host the website
- Provide uptime monitoring
- Keep Drupal Core and its associated modules up to date
- Provide a login method for the website (Shibboleth Module) to allow users to login with their NetID
DHTS will NOT:
- Provide training
- Migrate third party data to a Drupal environment
- Make programmatic or cosmetic changes to the website
- Edit or add content to the website
In addition to any and all contractual obligations and policies regarding Duke intellectual property the vendor will:
- Provide well written and secure code
- Provide proof of test validation prior to release
- Provide remediation and troubleshooting within an agreed upon window post-release
- Produce web applications in accordance with DHTS-vetted source code requirements
- Make requested cosmetic changes as defined by their contract with the customer
- Schedule and receive approval from DHTS for any production deployments a minimum of 5 business days in advance
All development and staging domains, as well as the intranet site, are only accessible if you are connected to the DHE network by being on campus or through VPN.