Healthcare data is being increasingly accessed over the public internet. With the rapid adoption of EHRs and patient portals, more and more healthcare technology providers are looking at providing the same features over the internet in a SaaS model to reduce feature to market time. As they embrace trends and begin supporting new use cases such as wearables, mobile health, AI and chat bots, more data gets transferred over the same public internet infrastructure Secondly, there is a pressing need to optimize the time healthcare professionals spend on IT per patient instead of patient care. Hence, getting timely and accurate information is of utmost importance to ensure better patient care. Patient engagement initiatives such as patient education, medication and visit reminder, positively impact patient outcomes and are a huge success if the applications built for the same provide seamless user experience. Internet based applications rely on HTTP. As web application became more prevalent, inefficiencies of HTTP need to be addressed. HTTP/2 (Hypertext Transfer Protocol Version 2) is the update to HTTP protocol that has been built with the aim of improving performance and reducing end user perceived latency, reducing network and server resource usage.This document introduces the features and benefits of HTTP/2 and how you can start using HTTP/2

1. This document is confidential and contains proprietary information, including trade secrets of CitiusTech. Neither the document nor any of the information
contained in it may be reproduced or disclosed to any unauthorized person under any circumstances without the express written permission of CitiusTech.
Speeding up Healthcare Applications
with HTTP/2
12, December 2017 | Author: Rita Thakor, Technical Architect; Khushboo Shah, Sr. Solution
Architect, CitiusTech
CitiusTech Thought
Leadership

2. 2
Speeding up Healthcare Applications with HTTP/2
 Healthcare data is being increasingly accessed over the public internet. With the rapid adoption
of EHRs and patient portals, more and more healthcare technology providers are looking at
providing the same features over the internet in a SaaS model to reduce feature to market time
 As they embrace trends and begin supporting new use cases such as wearables, mobile health,
AI and chat bots, more data gets transferred over the same public internet infrastructure
 Secondly, there is a pressing need to optimize the time healthcare professionals spend on IT per
patient instead of patient care. Hence, getting timely and accurate information is of utmost
importance to ensure better patient care.
 Patient engagement initiatives such as patient education, medication and visit reminder,
positively impact patient outcomes and are a huge success if the applications built for the same
provide seamless user experience
 Internet based applications rely on HTTP. As web application became more prevalent,
inefficiencies of HTTP need to be addressed
 HTTP/2 (Hypertext Transfer Protocol Version 2) is the update to HTTP protocol that has been
built with the aim of improving performance and reducing end user perceived latency, reducing
network and server resource usage
 This document introduces the features and benefits of HTTP/2 and how you can start using
HTTP/2

3. 3
Agenda
 Challenges with HTTP/1.x
 Introduction to HTTP/2 and Benefits to Healthcare Apps
 HTTP/2 Features Impacting Healthcare App Performance
 Web Server Support for HTTP/2
 Technology Support for HTTP/2
 HTTP/2 Browser Support and Availability
 HTTP/2 and Security
 Adopting HTTP/2 for Healthcare Applications
 Co-existence of HTTP/2 with Other Standards and Protocols
 References

4. 4
Challenges with HTTP/1.x
Slow Evolution
 Web has evolved since 1999, with the
advent of CDN and web pages hosting
dynamic and rich multimedia content
 Contrarily, HTTP protocol has been slow
to evolve with HTTP0.9 being first
released in 1991 and HTTP1.1 in 1997
 The most recent standard is HTTP/2
which has been released in 2015
Repetitive and Verbose Headers
 Data in the request headers to
the host is often verbose
 Multiple requests to the same
host lead to duplication and
redundant information is sent
repetitively over the network
 This is often very expensive for
mobile devices or low bandwidth
networks
Inefficient Use of TCP Protocol
 TCP uses a “slow start strategy” to control
congestion in network. HTTP1.x uses
underlying TCP connection and limits
processing to one request per TCP
connection
 Web browsers use multiple TCP connections
to service requests simultaneously. Multiple
parallel connections cause network
congestion, impacting performance and
resource utilization
 To work around the constraints of the
HTTP1.x protocol and to improve web
performance, developers have employed
different optimization hacks such as
bundling and minification, spriting,
domain sharding, and image inlining
 Developers also use HTTP pipelining to
reduce latency. However, due to
sequential nature of request-response
flow, it might also lead to ‘Head of Line
Blocking’ issue
Unnecessary Optimization Hacks

5. 5
Introduction to HTTP/2 and Benefits to Healthcare Apps
 Healthcare organizations today are
building patient portals with rich content
and media to increase patient
engagement. Additionally, they are also
developing richer user experiences for
healthcare providers with deeper
integration on extensive online
knowledge bases and clinical decision
support systems
 In the age of fast internet and technology
savvy population, patients and providers
expect healthcare applications to provide
them with necessary information within
milliseconds
 HTTP/2 is the latest version of the HTTP
protocol that enables loading healthcare
web applications much faster by
overcoming the inefficiencies associated
with HTTP/1.x
 HTTP/2 has been developed to achieve
primary goals of performance, simplicity,
robustness and high-level compatibility
with HTTP/1.1
Performance:
HTTP/2 protocol enables sending and receiving more data
per request-response cycle via multiplexing. The result is
superior web and mobile performance with reduced
latency and efficient usage of available bandwidth enabling
patients and providers to get information quicker.
Rich Experience:
HTTP/2 compresses the header information and reduces
the overhead in delivering rich multi-media content to end
users at faster speeds. Healthcare organizations can enable
richer user experiences for patients and providers.
Improved Resource Utilization:
HTTP/2 enables delivering the rich content efficiently by
leveraging header compression, multiplexing, stream
dependencies and server push. Healthcare IT costs can be
reduced with improved resource utilization and efficiency.
Security:
Healthcare organizations can deliver content securely to
patients and providers using HTTP/2, since it is a binary
protocol supporting encryption and requiring TLS 1.2 to
ensure better data protection.
Key Benefits of HTTP/2 to Healthcare Apps

6. 6
HTTP/2 Features Impacting Healthcare App Performance (1/4)
Feature Examples of Impact on Healthcare
Binary Protocol  Meaningful Use (MU) Initiative aims to improve clinical
outcomes and to empower patients and providers. For
healthcare organizations to be eligible to receive
incentives based on MU, digitizing health records and
making the health information available to patients via
patient portals becomes a key focus area
 Additionally, the incentives are based on the usage of
the portal by the patients, making it even more
important for organizations to keep the patients
engaged with faster load times
 One of the factors to achieve excellent application
performance with reduced load times would be to
deploy application on HTTP/2 enabled server
 HTTP/2 is a binary protocol, making it more efficient,
less error prone and more secure than text-based
HTTP/1.x. HTTP/2 eliminates the overhead of parsing
and translating to binary format resulting in
performance gains at lower level without resorting to
application level optimizations
Image source:
https://developers.google.com/web/fund
amentals/performance/http2/

7. 7
HTTP/2 Features Impacting Healthcare App Performance (2/4)
Feature Examples of Impact on Healthcare
Header Field Compression  Clinicians are adopting mobile devices to use
applications that help them research medications, view
patient records and to update patient’s EHR. Mobile
healthcare applications also facilitate the patients by
providing a secure and an efficient method of
exchanging clinical data with care providers
 The HTTP protocol is used to exchange this information
between mobile devices and servers. HTTP protocol
mandates the inclusion of complete information
required for server operation, as its stateless. For
multiple requests to same host, the header fields in
these requests are repetitive and verbose which
consume bandwidth and create overhead
 On the other hand, HTTP/2 uses HPACK. HPACK is a
header specific compression scheme which eliminates
redundant header fields, with reduced vulnerability to
security threats, resulting in reduced latency and faster
response times
 Healthcare mobile applications, which typically see
latency of several hundred milliseconds, even under
good conditions, would be benefited with this feature
Image source:
https://developers.google.com/web/fund
amentals/performance/http2/

8. 8
Feature Examples of Impact on Healthcare
Header Field Compression  Clinicians are adopting mobile devices to use
applications that help them research medications, view
patient records and to update patient’s EHR. Mobile
healthcare applications also facilitate the patients by
providing a secure and an efficient method of
exchanging clinical data with care providers
 The HTTP protocol is used to exchange this information
between mobile devices and servers. HTTP protocol
mandates the inclusion of complete information
required for server operation, as its stateless. For
multiple requests to same host, the header fields in
these requests are repetitive and verbose which
consume bandwidth and create overhead
 On the other hand, HTTP/2 uses HPACK. HPACK is a
header specific compression scheme which eliminates
redundant header fields, with reduced vulnerability to
security threats, resulting in reduced latency and faster
response times
 Healthcare mobile applications, which typically see
latency of several hundred milliseconds, even under
good conditions, would be benefited with this feature
HTTP/2 Features Impacting Healthcare App Performance (3/4)
Image source:
https://developers.google.com/web/fund
amentals/performance/http2/

9. 9
Feature Examples of Impact on Healthcare
Server Push  To provider better patient outcomes, the providers need
patient’s health record information as quickly as the
patient arrives for the visit. Providing all the EHR
information with minimal wait time, enables the
provider to spend more time caring for patient rather
than with healthcare IT application, in turn improving
patient experience
 “Server Push“ is a feature that allows sending multiple
responses in parallel for a single client request. The
patient dashboard may require additional information
like vitals, allergies, medication, lab results, etc. These
resources can be pushed from server ahead of any
explicit client requests. The server pushed resource can
be cached by client and reused across different pages
 For client to know which resources the server intends to
push, PUSH_PROMISE frames are sent first with HTTP
headers of the promised resources, which in turn can be
declined by the client (e.g., if resource is already cached)
HTTP/2 Features Impacting Healthcare App Performance (4/4)
Image source:
https://developers.google.com/web/fund
amentals/performance/http2/

10. 10
Web Server Support for HTTP/2
 Support for HTTP/2 is
introduced from IIS
10.0, Windows 10 and
Windows Server 2016
 To verify that requests
are going via HTTP/2,
switch on IIS Logging
‘Protocol version’
 IIS would fall back to
HTTP1.1 for:
o Windows
Authentication
(NTLM/Kerberos/N
egotiate)
o Clear Text
o Bandwidth
Throttling
 Currently, IIS supports
HTTP/2 only over TLS
More details:
Microsoft IIS and HTTP/2
 Support for HTTP2 is
also introduced in
Apache version
2.4.17 with
mod_http2 module
 mod_http2 that
comes with Apache
versions prior to
2.4.26 are marked as
insecure and hence
versions later to
2.4.26 should be used
 Support for HTTP2 in
Tomcat 8.5
 Apache httpd
supports HTTP/2 over
clear text (h2c) as
well as secure
connections (h2)
More details:
Apache and HTTP/2
 Support for HTTP2 is
introduced from
NGINX version 1.9.5
 To upgrade to version
1.9.5:
o Remove the spdy
parameter from all
listen directives
o Change
configuration to
redirect all traffic
to TLS/SSL
o Add http2
parameter to all
listen directives
along with SSL
parameter
o Restart NGINX
More details:
NGINX and HTT/2
 Support for HTTP2 is
introduced from
Node 8.4.0
(experimental)
 Core API provides a
low-level interface
designed specifically
around support for
HTTP/2 protocol
features
 Node.js must be
launched with the --
expose-http2
command line flag in
order to use the
'http2' module
More details:
NodeJS and HTTP/2
Microsoft IIS Apache NGINX http server Node server

11. 11
Technology Support for HTTP/2
 To enable HTTP/2, new features
were added to Windows 10, IIS
10 and ASP.NET
 Support for HTTP/2 has been
added to ASP.NET in the .NET
Framework 4.6
 HTTP/2 is also supported by
default for Windows 10 Universal
Windows Platform (UWP) apps
that use the
System.Net.Http.HttpClient API
 PushPromise(String) and
PushPromise(String, String,
NameValueCollection), has been
added to the HttpResponse class
 Support for HTTP/2 has been added to Java 9
with new HTTP client API
 The new HTTP client API implements HTTP/2
and WebSocket, and replaces the legacy
HttpURLConnection API
 The API is delivered as an incubator module,
as defined in JEP 11, with JDK 9. The module
is called jdk.incubator.httpclient. This
incubator module will be replaced by
java.httpclient in JDK 10.
http://openjdk.java.net/jeps/110
 The features from HTTP/2,viz.
Request/Response multiplexing, Stream
Prioritization, Server Push, Upgrade from
HTTP 1.1, are expected to be exposed by the
Servlet 4.0 API with Java EE 8
https://www.jcp.org/en/jsr/detail?id=369
Microsoft .NET Java

12. 12
 HTTP/2 is already available with many web servers, browsers and mobile support
 All the below mentioned browsers support HTTP/2 but only for SSL (HTTP/2 over TLS is supported
currently)
Web Server Support
 Microsoft IIS supports HTTP/2 in Windows 10 and Windows Server 2016
 NGINX open source version 1.9.5 includes HTTP/2 support
 Apache Tomcat 8.5 and higher include HTTP/2 support
 “Node.js” supports HTTP/2 with node-http2 version 1.0.1 API
Tools Support
 Wireshark supports HTTP/2, to intercept traffic between a client and server
 Debugging in browser could be achieved via “Net Internals Console”, built-in chrome browser
 Command line debugging using H2I
 Fiddler currently does not support debugging HTTP/2 enabled request/response
Chrome Chrome for iOS Firefox IE Opera
Support by default     
Verified on version >41 >41 >36 11 (on Win 10) >28
HTTP/2 Browser Support and Availability

13. 13
HTTP/2 and Security
 HTTP/2 was designed on the basis of SPDY, which in turn was designed to require SSL/TLS
 HTTP/2 does not mandate using TLS, but since Mozilla has stated that Firefox would only support
HTTP over SSL/TLS and so far Microsoft and Google have released HTTP only over SSL/TLS, it is
recommended to use TLS for HTTP/2 sites. Moreover, using TLS in sites would improve overall
security of web
 To ensure security of sites using Web Application Firewall (WAF):
• It may happen that WAF, not keeping pace with HTTP/2 development, may end up being
vulnerable to web security attacks when communicating over HTTP/2 protocol
• Even if WAF would be able to see decoded encrypted content, it will not be able to detect
web application level attacks
• In such a scenario, the recommended solution would be to deploy HTTP/2 gateway in front
of the web application’s server farm
• The gateway shall translate the client browsers’ communication from HTTP/2 to HTTP 1.1
towards the server, and vice versa
Image source: http://blog.radware.com/security/2015/09/http2-security-fix/

14. 14
Adopting HTTP/2 for Healthcare Applications
 Healthcare organizations can start using HTTP/2 for their web applications by following a few
simple steps:
• Enable HTTPS protocol for the website (after installing a valid SSL or TLS certificate on the
website)
• Ensure that the server infrastructure and software supports HTTP/2
• Test if HTTP/2 has been configured correctly using HTTP/2 test or HTTP2.Pro
 Healthcare organizations can also adopt HTTP/2 using ADC (application delivery controller). Some
ADC’s have HTTP/2 gateway feature that enables protocol translation from HTTP/2 on the client
side to HTTP1.1 on the server side, and vice versa. Some ADC’s also add more intelligence on
implementation, by using algorithms to determine which objects to push to the client , enabling
the new server push capability
Image Source : http://blog.radware.com/applicationdelivery/applicationaccelerationoptimization/2015/07/what-to-know-about-http2/

15. 15
Co-existence of HTTP/2 with Other Standards & Protocols (1/2)
Protocol/Standard Co-existence with HTTP/2
Web Socket  Lack of bidirectional capabilities have often been perceived as a major
drawback when comparing SSE (Server-Sent Events) to WebSocket. HTTP/2
overcomes this drawback by design
 WebSocket will survive as it is well adopted and it has been built from the
ground up for bidirectional capabilities with less overhead
 WebSocket might continue to find usage in use cases where there is need of
exchanging a high throughput of messages from both ends, with almost as
much data flow upstream than downstream (i.e. Multiplayer Online Game)
Content Delivery Network  Content delivery network is used to speed up the delivery of resources over
the web
 HTTP/2 would not remove the need of CDN, as CDN decreases round trip
time (RTT) further
 In addition, CDNs bring to fore a huge set of other values, like offloading,
reliability, security and more, which are hardly affected by HTTP/2

16. 16
Co-existence of HTTP/2 with Other Standards & Protocols (2/2)
Protocol/Standard Co-existence with HTTP/2
Quick UDP Internet
Connection (QUIC)
 QUIC is a new multiplexed and secure transport atop UDP, designed from the
ground up and optimized for HTTP/2 semantics
 QUIC is functionally equivalent to TCP+TLS+HTTP/2, but implemented on top
of UDP
 Key advantages of QUIC over TCP+TLS+HTTP/2 include: Connection
establishment latency, flexible congestion control, multiplexing without
head-of-line blocking, authenticated and encrypted header and payload,
stream and connection flow control, forward error correction, etc.
 There are specifications on how HTTP/2 semantics can be offered over a
QUIC implementation.
More details: https://tools.ietf.org/html/draft-tsvwg-quic-protocol-02#section-12
Bottleneck Bandwidth and
Round-trip Propagation Time
(BBR)
 BBR is a new congestion control algorithm developed by Google
 BBR enables big throughput improvements on high-speed and long-haul links
 BBR's throughput is 2700x higher than today's best loss-based congestion
control, CUBIC
 Because of this loss resiliency, a single BBR connection can fully utilize a path
with packet loss. This makes it a great match for HTTP/2, which uses a single
connection, and means users no longer need to resort to workarounds like
opening several TCP connections to reach full utilization

17. 17
References
 Introduction to HTTP2 - Wiki
 Fundamentals to HTTP/2
 All about HTTP/2
 Why we need another version of HTTP protocol?
 What to know about HTTP/2
 HTTP/2 is Speedy and Secure
 HTTP/2 Security Fix

18. 18
Thank You
Authors:
Rita Thakor
Technical Architect
Khushboo Shah
Sr. Solution Architect
thoughtleaders@citiustech.com
About CitiusTech
2,700+
Healthcare IT professionals worldwide
1,200+
Healthcare software engineering
700+
HL7 certified professionals
30%+
CAGR over last 5 years
80+
Healthcare customers
 Healthcare technology companies
 Hospitals, IDNs & medical groups
 Payers and health plans
 ACO, MCO, HIE, HIX, NHIN and RHIO
 Pharma & Life Sciences companies