Architecting Diagnostic Delivery: Application Streaming and Zero-Footprint Clients
Storing the data securely and efficiently in the AWS cloud is only part of the architectural equation; clinicians require highly performant visual interfaces to interact with the data.
The shift to AWS architecture supports two distinct delivery mechanisms for diagnostic viewing, catering to both modern web applications and legacy software dependencies.
Delivery Architecture Overview
Australian healthcare organizations must carefully evaluate their clinical workflows, existing software investments, and network infrastructure when choosing between zero-footprint web viewers and application streaming solutions.
Hybrid Approach
Many Australian radiology networks deploy both OHIF for general viewing and AppStream 2.0 for specialized workstations, optimizing cost and user experience based on clinical role and location.
Web-Based Zero-Footprint Viewers: OHIF Architecture
The most agile and modern approach leverages web-based, zero-footprint viewers, such as the open-source OHIF Viewer, which can be directly and seamlessly integrated with AHI's backend.
Utilizing an AWS Cloud Development Kit (CDK) deployment, the viewer's frontend application code is hosted and globally distributed via Amazon CloudFront, AWS's Content Delivery Network.
That end-user view is the reason the architecture matters. The point of CloudFront, DICOMweb, and token signing is not abstract modernization; it is to give clinicians a responsive viewer with measurement and hanging-protocol style workflows without deploying thick-client software to every endpoint.
OHIF Architecture Components
OHIF viewer architecture on AWS
| Component | Technology | Deployment | Purpose |
|---|---|---|---|
| Frontend Application | React + Vite | Amazon S3 + CloudFront | Zero-footprint viewer UI |
| Authentication | Amazon Cognito | Edge via Lambda@Edge | OIDC identity provider |
| API Gateway | Amazon API Gateway | Regional endpoint | Secure DICOMweb routing |
| Token Signing | Lambda@Edge | CloudFront edge locations | JWT signing for AHI access |
| Image Retrieval | DICOMweb WADO-RS | AWS HealthImaging | Progressive image streaming |
| Metadata Search | DICOMweb QIDO-RS | AWS HealthImaging | Study/series querying |
| Session Storage | Amazon DynamoDB | Regional table | User preferences and hanging protocols |
OHIF Architecture on AWS
Loading diagram...
Authentication Flow
User authentication is managed dynamically at the network edge utilizing Amazon Cognito acting as the identity provider via OpenID Connect (OIDC) protocols. Lambda@Edge functions intercept HTTP requests and cryptographically sign the API calls before they reach the backend.
OHIF authentication and image retrieval flow
Loading diagram...
Serverless Architecture Benefits
This serverless architecture eliminates the need for hospital IT to manage frontend application infrastructure, ensures zero patient data is persistently stored locally, and guarantees direct interaction with AHI's DICOMweb APIs.
Amazon AppStream 2.0 for Legacy Thick Clients
Despite the advantages of web viewers, many healthcare facilities remain heavily dependent on highly proprietary, heavily customized Windows-based diagnostic software.
These "thick clients" often contain FDA-approved specialized tools for intricate tasks like cardiac mapping or oncological volumetric analysis, and they cannot be easily or quickly rewritten as web applications. Providing remote access via traditional VPNs and RDP exposes patient data to severe security risks and suffers from crippling latency.
To modernize the delivery of these legacy applications, AWS Solution Architects deploy Amazon AppStream 2.0, a fully managed application streaming service that allows users to access demanding desktop applications through a standard HTML5 web browser.
AppStream 2.0 Client Streaming Architecture
Loading diagram...
AppStream 2.0 Security Architecture
Users access an AppStream 2.0 URL and authenticate via SAML through their hospital's existing Active Directory. Upon successful authentication, the browser receives a SAML assertion from Amazon Cognito, granting temporary, scoped AWS security credentials.
The user is then connected to an ephemeral AppStream 2.0 streaming instance—backed by scalable Amazon EC2 compute. For heavy radiological interpretation, architects deploy high-performance graphics instances equipped with dedicated GPUs.
The legacy PACS software runs entirely within the secure enclave of the AWS VPC. The crucial innovation is that no actual DICOM data or patient files are ever downloaded to the user's remote device; instead, AppStream 2.0 utilizes the NICE DCV protocol to stream only the encrypted, changing pixels of the application interface.
AppStream 2.0 SAML Authentication Flow
Loading diagram...
Profile Persistence
Amazon FSx or S3 can be integrated to persistently store and mount individual user profiles and application settings at the start of each ephemeral session, ensuring radiologists retain their customized hanging protocols.
Delivery Mechanism Comparison
The following table compares the two diagnostic delivery mechanisms available on AWS.
OHIF vs AppStream 2.0 delivery comparison
| Feature | OHIF Zero-Footprint | AppStream 2.0 |
|---|---|---|
| Use Case | Modern web applications | Legacy Windows thick clients |
| Installation | Zero-footprint (browser only) | No local install (streamed) |
| Authentication | Cognito OIDC | SAML Active Directory |
| Data Location | No local data storage | No data download (pixel streaming) |
| Distribution | CloudFront CDN | EC2 streaming instances |
External References
For further reading on diagnostic delivery and viewer technologies:
OHIF Viewer
Open source zero-footprint medical image viewer integrating with AWS HealthImaging
View on GitHubOHIF Viewer Documentation
Open Health Imaging Foundation viewer documentation and deployment guides
Read moreDICOMweb-JS Library
JavaScript library for DICOMweb RESTful services. Enables browser-based WADO-RS, QIDO-RS, and STOW-RS integration for zero-footprint viewers.
View on GitHubKnowledge Check
Test your understanding with this quiz. You need to answer all questions correctly to mark this section as complete.