Merge eClinical provides world-class hosting services for clinical trials that ensure high system availability, security, and reliability. Their data centers have redundant infrastructure and disaster recovery systems. As a recognized leader in clinical trial hosting, Merge eClinical guarantees high service levels across applications and environments to minimize business risks. Their security measures include physical security of facilities, network security, host security, and an antivirus policy. Merge eClinical uses high-end servers and networking architecture with redundancy to ensure reliability of trial systems and data.

1. World-class Hosting Services

2. synchronized
intelligence
trial site patient
intelligence intelligence intelligence
Wo r l d - C l a s s H o s t i n g S e r v i c e
t H e m e r g e e c l i n i c a l a d va n ta g e
Merge eClinical’s application hosting services go beyond standard hosting
merge eclinical’s highly robust
by providing a holistic solution to essential business continuity, resiliency
and security. Merge eClinical has invested heavily to help you attain the
hosting services help ensure:
peak performance your trials need to always be running quickly, efficiently • Trial downtime is mitigated with
and in a security-rich and industry-compliant environment. state-of-the-art disaster recovery
systems
Recognizing your critical need to access trial data at any time and in
virtually any location around the world, Merge eClinical has assembled a • Critical systems, IT processes and
highly talented team of IT professionals. Having successfully networks are highly available
implemented more than a thousand trials, you can rely on our proven
• Service levels are guaranteed across
experience and certified technical knowledge to support your trial
environments. applications and operating
environments
Managed by Peak10, a recognized leader in IT site services, our data • Business risk is greatly reduced due
center facility is able to ensure the network is highly available, reliable,
to unanticipated events
redundant and secure. The data center is fitted with the latest hardware
and software platform technology, disaster recovery and is configured for
scalability. Merge eClinical manages your eClinical platform and
applications to ensure consistent and reliable performance, while maintaining operations under virtually any condition.
HoSting infraStructure
Merge eClinical houses study data in a secure, state-of-the-art hosting center and includes:
• Superior service level agreements
• High-performance connectivity
• Redundant network and disaster recovery measures for high availability
• A rich set of security services
Service Level Guarantee
Merge eClinical provides a Service Level guarantee that the system will be available to users in excess of 99% of the time. Due to the
nature of most client activities, it is understood that the system often needs to be operational outside of regular business hours. The
production server environment does not require system shutdown for daily data back-up, and with the exception of short periods for
scheduled maintenance (conducted overnight on weekends) the system will be available on a 24/7 basis.
Data Protection
Continuous data protection is achieved with a powerful EMC SAN. Advanced storage capabilities include simple management tools,
continuous data availability and integrity, high performance data mobility and scalability. Additionally, Merge eClinical utilizes local
replication for backup/restore and remote replication for disaster recovery and data mobility.

3. Security
Physical security
Production & disaster recovery data centers
The data center restricts and monitors access using the following methods:
• 24/7 onsite security personnel • Proximity card access throughout the facility
• Client security escort • Access is restricted to authorized personnel
• Electronic motion detectors • There is a fire suppression system in place
• Continuous video camera surveillance • Reinforced exterior and interior walls
• Unified security breach alarm with • Raised floors for secure cable routing
access monitoring • Temperature and water sensors
• Biometric fingerprint scan identification system
Merge eClinical headquarters
The following are high level security features at the physical location of our headquarters office:
• Access is restricted to authorized personnel • Break glass monitoring system
• Proximity card access throughout the facility • 24/7/365 badge access monitoring system
• Motion detection system • Fire suppression system
• Defcon Halogen units located in secured areas • Master key access for only senior management
• 24/7/365 badge access monitoring system team members
Network Security
• Redundant firewalls with IPS (Intrusion • State-of-the-art VPN connection between our
Prevention Systems), protecting the wireless ISP and the production network
infrastructure from internal or external attacks provides secure data transmissions between
• Data transfer between clients and Merge our diary devices and the servers
eClinical is over the Internet, operating on • Secure SSL/TSL encryption at the mail
secure port https gateway
• Firewall controls inbound and outbound • Security-rich process for managing account
access to Merge eClinical equipment and is generation, maintenance and termination for
only enabled through designated ports maintenance, as well as user accounts
• Hardened router configurations • Administrative access to Merge eClinical
• Anti-virus protection systems are limited and based on group
• Secure File Transfers via public SSH server membership
Host Security
• Patches are applied to Merge eClinical • System access logs are local to the systems
systems as available and after thorough • Access limited to certain IP address ranges
assessment • All privileged use is logged
• Administrative access to Merge eClinical • Security-related events are logged and
systems is limited and based on group reviewed daily, including:
membership o User login failures
• Merge eClinical systems are administered o Failure to obtain privileged access
remotely o Access policy violations
• Utilization of Windows® terminal services o Administration events
client o Access policy modifications
Antivirus Policy
• McAfee® Virus Scan Enterprise anti-virus solution
• All devices placed on the network system are patched prior to initial connection
• Virus definitions are updated daily via automatic updates
Incident response policy
Internal employees are trained on procedures for reporting security incidents

4. arcHitecture
Network
Merge eClinical has invested more than $1M U.S in its new network
infrastructure. High availability is achieved through the use of
redundant firewalls at the network gateway and high-end core
switches internally. Network security is enhanced by the use of an
IPS at the network gateway.
Production Application/Database
Merge eClinical utilizes a three-tier high availability design for its
application and database hosting:
• Tier one are the application servers, which utilize blade servers
for their compact design, speed, and ease of expansion.
• Tier two is a database cluster which provides high availability and
scalability of the database.
• Tier three is a SAN (Storage Area Network) which houses the
databases and provides speed, high availability, scalability,
redundancy and security.
Reliability
reliability Reliability
Server hardware
etrials uses only high-end IBM
Server Hardware Server hardware
achieve full redundancy with re
etrials uses only high-end IBM and Dell servers to host all client applications. Servers
Merge eClinical uses only high-end IBM and Dell servers to host all client applications. Servers
achieve full redundancy with redundant power supplies, processors, network mirrored operatin
connections,
achieve full redundancy with redundant power supplies, processors, network connections, mirrored RAID-5 data storage.
connections, mirrored operating system drives and
operating system drives and RAID-5 data storage. Data center
Data center The following are reliability fea
The following are reliability features of the physical data center: Redundant air conditio
Data Center Redundant air conditioning systems Raised floor designed
The following are reliability features of the physical data center: floor designed for efficient cooling
Raised Static transfer switche
• Redundant air conditioning systems • Certifiedtransfer switches and fully redundant UPS
Static technical staff onsite 24/7 Backup diesel genera
Backup diesel generator entrances State-of-the-art netwo
• Raised floor designed for efficient cooling • Redundant and diverse fiber
State-of-the-art network operations center Certified technical staf
• Backup diesel generator • Multi-homed Internet backbone with DS-3, Redundant and divers
Certified technical staff onsite 24/7
• Static transfer switches and fully OC-3 and Gigabit diverse fiber entrances
Redundant and Ethernet connections Multi-homed Internet b
redundant UPS using BGP-4 routing protocol
Multi-homed Internet backbone with DS-3, OC-3 and Gigabit Ethernet connections using BG
• State-of-the-art network operations center connections using BGP-4 routing protocol
4

5. t e l e c o m m u n i c at i o n S
Merge eClinical telecommunications vendors are required to maintain redundant systems in the event
of a failure.
Advanced Phone System
Merge eClinical uses an IP phone system that enables locations to be connected 24/7/365. The
phone system can be used as a disaster recovery process when phones are programmed in the
teleworker mode in the event of an emergency.
Automatic Call Dialer (ACD) System
The Merge eClinical ACD system is state-of-the-art and enables our helpdesk staff to quickly,
efficiently and knowledgably aid in the handling of any issues that may occur while assisting our
clients. Report generation can be obtained through this system for all calls entering the ACD network.
Fax Server
Merge eClinical uses a robust fax server for all external/internal faxing.
S ta n d a r d o p e r at i n g p r o c e d u r e S
Merge eClinical follows a very detailed set of operating procedures to ensure the security and
confidentiality of information. The procedures also identify hiring and training methods, project
design and control, quality control and customer support.
Call today 866.387.4257 or visit www.merge.com/eclinical
Merge Healthcare utilizes decades of technology, expertise, intellectual property, innovative software development and expert services to build IT solutions for
healthcare and biopharmaceutical customers worldwide. We bring a customer-driven enthusiasm that assures etrials Service Delivery remains relevant to your
business goals, now and into the future. Copyright 2009 Merge Healthcare Incorporated.