Update – 6 May 2025
Please note the latest updates related to the API Gateway migration and cipher suite deprecation as outlined in FLASH25-0022-2.
As part of the ongoing migration of Oracle Health API gateways from AWS to Oracle Cloud Infrastructure (OCI), and the deprecation of weak TLSv1.2 cipher suites, the following changes have been made:
Updated Key Dates:
- Non-Production: Weak cipher suites are no longer supported as of May 1, 2025.
- Production: Weak cipher suites will be deprecated after June 30, 2025.
- IP Range Updates: Deadline for implementing new Oracle-hosted IP ranges has been extended to June 1, 2025.
We encourage all clients and partners to:
- Ensure their environments are updated to support modern cipher suites.
- Enable the new OCI IP ranges in their firewalls and proxies by the revised deadline.
For full details, refer to the latest Flash:
FLASH25-0022-2 (PDF)
Let us know if you have questions or need help validating your environment for these updates.
------------------------------------------------------------------------------------------------------------------
We are writing to inform you of an update regarding upcoming changes for FHIR and Millennium API network routes & hosting infrastructure. This change impacts all EHR APIs, FHIR APIs for Millennium, and Oracle Soarian Clinicals FHIR APIs.
Oracle Health is migrating Oracle Health API gateways from Amazon Web Services (AWS) to Oracle Cloud Infrastructure (OCI)-based hosting; this work will begin 11 April 2025.
Additionally, we are dropping support for legacy cipher suites as part of this infrastructure change:
- TLSv1.2: C028: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: ECDHE-RSA-AES256-SHA384
- TLSv1.2: 009F: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: DHE-RSA-AES256-GCM-SHA384
- TLSv1.2: 006B: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: DHE-RSA-AES256-SHA256
- TLSv1.2: C027: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: ECDHE-RSA-AES128-SHA256
- TLSv1.2: 009E: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: DHE-RSA-AES128-GCM-SHA256
- TLSv1.2: 0067: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: DHE-RSA-AES128-SHA256
Key Dates to Note:
- Announcement Date: 21 March, 2025
- Transition Period Starts: 11 April, 2025
What does this mean for you?
- Affected Services: All applications calling EHR, MyRecord, eCR, Millennium APIs
- Call to Action: Ensure network routes for calls to Oracle-hosted IP Ranges are allowed.
To ensure that connectivity is maintained during and after the migration, new IP ranges are available across our system. Enable the new IP ranges for connectivity through any network software or hardware-based firewalls, proxies, or other systems deployed to filter ingress and egress of internet traffic, no later than 11 April 2025.
Resources:
FLASH ID: FLASH25-0022-1
3/26/25 - This has been updated to address a typo in the cipher suites we are removing support for (TLSv1.2: 009E: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: DHE-RSA-AES128-GCM-SHA25 to TLSv1.2: 009E: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: DHE-RSA-AES128-GCM-SHA256)