Configure Health Canada AS2 Connection

Set up a Vault Safety Health Canada AS2 Connection and Transmission Profiles to support clinical trial and postmarket electronic submissions to Health Canada.

About AS2 Connection Support for the Health Canada Gateway

Vault Safety supports electronic submissions to Health Canada (HC) through AS2 (system-to-system) communication. Vault Safety supports clinical trial and postmarket electronic submissions to Health Canada’s Canada Vigilance Program (CVP).

Note: Contact Veeva Managed Services for guidance on best practices before configuring the HC CVP AS2 Connection.

Once the AS2 Connection and Transmission Profiles are configured, you can transmit ICSRs to Health Canada using the HC E2B(R2) .xml document format on a Submission.

Note: If your Vault currently uses the HC Gateway Profile to communicate with Health Canada, we recommend that you create an AS2 Connection to Health Canada as described in this article and then follow the instructions in Replace a Gateway Profile with an AS2 Connection.

Prerequisite

Ensure your Vault has the following configuration before you configure electronic submissions to Health Canada:

The Transmission Profile with the API Name hc_cvp__v should be named HC MHPD, with a Destination ID of “MHPDVAL”.
To allow users to manually specify values for the Message Type (M.1.1) E2B data element when preparing Submissions to Health Canada, add the Message Type (HC) (message_type_hc__v) field to the Submission layout.
The Health Canada Agency must be in the Active state. Health Canada is a standard Agency provided with Vault Safety. However, in certain Vaults, an Admin must activate the Agency record.

Activate the Health Canada Organization

Health Canada comes preconfigured in each Vault as a standard Organization. In certain Vaults, an admin must make the Agency active. Complete the following steps if Health Canada is inactive in your Vault:

Go to Business Admin > Organizations.
Open the Health Canada Agency record.
Select the All Actions menu.
Select Change State to Active.

Note: The Change State to Active user action will only appear if it has been configured in your Vault. Add User Action to the Organization Lifecycle Inactive State provides instructions for this configuration.

Configure a Health Canada CVP AS2 Account

Before you can configure the Vault Safety Gateway Profile, you must have an active Health Canada CVP AS2 account.

When you configure your account, ensure that the AS2 URL exactly matches the AS2 Vault URL of your AS2 Connection.

Public and Private Certificates

As part of the HC registration process, you must obtain a public and private certificate pair and send the public certificate to HC. If you need help generating these certificates, contact Veeva Managed Services.

Configure a Vault Safety AS2 Connection

Go to Admin > Connections, then select Create.
For the Connection Type, select AS2, then select Continue.
Complete the AS2 Connection Fields.
Select Save.

AS2 Connection Fields

Field	Description
Name	Enter a name for the AS2 Connection. This name must be unique in your Vault.
API Name	Enter an API Name for the AS2 Connection. This name must be unique in your Vault.
Contact Email	Enter the Sender's Email.
Description	Enter a description for the AS2 Connection.
AS2 Vault Gateway State	Vault populates this field with the current state of the AS2 Vault Gateway, which consists of one (1) of the following options: Unregistered: The Sync to Gateway action has not yet been run for this AS2 Connection. Registered: The AS2 Connection is synchronized with the Gateway. Out of Sync: Changes have been made to the AS2 Connection or its Connection Allowed List since the last time the Sync to Gateway action was run. From the All Actions menu, select Sync To Gateway to resync the AS2 Connection with the Gateway.
AS2 Additional ACK Stages	If required, select one (1) or more of the following options: HTTP Handshake: Used primarily for asynchronous requests. PRE-ACK: Used mainly for FDA VAERS, but can be used with synchronous or asynchronous requests. Note: We do not recommend using any additional ACK stages.
AS2 Encryption	The algorithm Vault uses to encrypt outbound AS2 messages and decrypt inbound messages. Vault supports the following algorithms: Triple DES (3DES) AES-256-GCM AES-256-CBC For Health Canada, select Triple DES (3DES).
AS2 MDN Setting	Whether the Message Delivery Notification (MDN) can be exchanged synchronously (Sync) or asynchronously (Async). For Health Canada, select Sync.
AS2 Signature	The method Vault uses to sign outbound AS2 messages. Vault supports the following signing methods: SHA-1 SHA-256 For Health Canada, select SHA-256.
AS2 Compress Before Sign	If you select this option, Vault compresses messages before applying the Signing Algorithm. If you do not select this option, Vault compresses messages after applying the Signing Algorithm. Note: We recommend leaving this option unselected.
AS2 Partner ID	Enter one of the following Health Canada identification codes: For a production account, enter `HC`. For a test account, enter `HC`.
AS2 Partner URL	Enter one (1) of the following destination Health Canada Gateway URLs: For a production account, enter `https://cvp.hc-sc.gc.ca:9442/msgsrv/as2`. For a test account, enter `https://cvp.hc-sc.gc.ca:9443/msgsrv/as2`.
AS2 Partner Certificate Expiry	Vault automatically populates this field when your Admin uploads the Partner Certificate.
AS2 Vault ID	Enter the sponsor ID registered with Health Canada.
AS2 Vault URL	Enter the AS2 URL of your Vault in the following format, replacing `<SponsorName><Partner><Environment>` with the corresponding values of your Vault: `https://<SponsorName><Partner><Environment>.gateway.veevavaultsafety.com:4080` The following example demonstrates how to form the AS2 Vault URL for a Vault with the following values: `<SponsorName>` = vern `<Partner>` = hc `<Environment>` = validation AS2 Vault URL = `https://vernhcvalidation.gateway.veevavaultsafety.com:4080` Informing the Partner of your AS2 Vault URL When informing the Partner of the URL they need to use for this AS2 connection, use the value you entered in this field appended with `/api/v1/inbound/transmission/`. In the example shown above, this is `https://vernhcvalidation.gateway.veevavaultsafety.com:4080/api/v1/inbound/transmission/`.
AS2 Vault Certificate Expiry	Vault automatically populates this field when your Admin uploads the Sponsor Certificate.
AS2 Vault Domain / IP Configuration	Select the method the Partner uses to interface with the AS2 Connection. AS2 Vault URL: Domain Name (typical): A standard domain name that resolves to dynamic IP addresses. AS2 Vault URL: Domain Name bound to static IP addresses: A standard domain name that resolves to static IP addresses. AS2 Vault URL: IP URL (uncommon): A non-standard IP address domain name that resolves to an IP address. For Health Canada, select AS2 Vault URL: Domain Name (typical).
AS2 Ingress IPs	If you set the AS2 Vault Domain / IP Configuration field to AS2 Vault URL: Domain Name bound to static IP addresses, Vault populates this field automatically.

Vault Safety uses the Partner and Sponsor certificates to communicate securely with the Partner.

You will have received the Partner certificate as part of creating your account with the Partner.

If you need help generating a Sponsor certificate, contact your Veeva Representative.

Upload Partner Certificate

Go to Admin > Connections > [Connection].
From the All Actions menu, select Upload Partner Certificate.
Select Choose, then select the Partner’s Public Certificate.
The following accepted formats are:
- PKCS7 (.p7b or .p7c)
- DER (.cer or .der)
- PEM (.cer, .crt, or .pem)
  Vault checks the expiry date of the certificate. If the certificate is no longer valid, you cannot save the record.
Select Continue.

Go to Admin > Connections > [Connection].
From the All Actions menu, select Upload Sponsor Certificate.
Select Choose, then select the Sponsor’s Public Certificate.
The accepted formats are PKCS12 (.pfx or .p12)
Vault checks the expiry date of the certificate. If the certificate is no longer valid, you cannot save the record.
Select Continue.

Add Connection Allowed IPs

Specify one (1) or more Allowed Connections for the AS2 Connection. These are Internet Protocol (IP) addresses that Vault will allow to connect with this AS2 Connection.

Note: To obtain the latest list of allowed connections for Health Canada, contact your Veeva Representative.

Perform the following steps for each Allowed Connection you want to add to the AS2 Connection:

Go to Admin > Connections > [Connection].
Go to the Connection Allowed Lists section, then select Create.
On the Create Connection Allowed List window, complete the following information:
- Name: Enter a name for the Allowed Connection.
- (Optional) Description: Enter a description for the Allowed Connection.
- IP: Enter the address of the Allowed Connection.
  Ensure the format of the IP address is XX.XX.XX.XX or XX.XX.XX.XX/{subnet mask} where the {subnet mask} is a number between 24 and 32.
Repeat the above steps for each Allowed Connection.
When you have added all the Allowed Connections, select Save.

Note: By default, Vaults are limited to 512 Allowed Connections. If your organization requires more, contact your Veeva Representative.

Synchronize the Connection

Once you have entered all the details of the AS2 Connection, the Connection must be synchronized with the Gateway.

From the All Actions menu, select Sync Connection to Gateway.

When Vault successfully completes this action, the Connection’s AS2 Vault Gateway State changes to Registered and Vault can send and receive messages using this Connection.

Note: If the Sync Connection to Gateway action is not successful, ensure each field value on the AS2 Connection is correct before retrying the action again. If the issue persists, contact your Veeva Representative.

If you make any changes to the Connection object or its Connection Allowed List, the AS2 Vault Gateway State changes to Registered - Out of Sync. Vault cannot send or receive any messages using this Connection while it is in the Registered - Out of Sync state. You will need to repeat the All Actions > Sync to Gateway action to restore the Connection to the Registered state.

Result

The HC AS2 Connection is active and available to use to submit case reports to Health Canada.

Note: Because Health Canada does not allow testing with third-party vendors, their gateway has not been vendor-tested with Vault Safety. You must perform additional testing when setting up Health Canada electronic submissions. Contact Veeva Managed Services for assistance.

Add a Submission Rule Set

Vault Safety comes preconfigured with Health Canada as a standard Organization. To define Case criteria for Submissions to the HC CVP Gateway, add a Submission Rule Set to the Organization record by completing the following steps:

Go to Business Admin > Objects > Organizations.
On the Organizations page, select Health Canada.
On the Health Canada page, select Edit.
Under Details, in the Submission Rules field, select a standard Rule Set from the dropdown.
Select Save.

Note: Reporting Rule Sets provides more information about the available Rule Sets. If these do not fulfill your requirements and you need a different Rule Set, contact your Veeva representative.

Result

Vault can now auto-generate Submission records for ICSR Submissions to Health Canada based on the Rule Set you selected.

Configure Health Canada Transmission Profiles

Vault Safety comes with standard, system-provided Transmission Profiles for Health Canada Submissions. You must configure these Transmission Profiles as part of the Health Canada Gateway setup.

The following table lists the Vault-provided Health Canada Transmission Profiles:

Transmission Profile	Usage
HC MHPD	For submitting postmarket reports to Health Canada's Marketed Health Products Directorate (MHPD)
HC TPD	For submitting clinical trial reports to Health Canada's Therapeutic Products Directorate (TPD)

Manage Transmission Profiles provides instructions on setting up Transmission Profiles.

When setting up the Transmission Profiles, see the following guidance on setting the Origin and Destination IDs:

Origin ID: Enter the Sponsor ID registered with Health Canada.
Destination ID: Enter the Destination ID for the Health Canada Gateway. You can specify one (1) of the following IDs:

Transmission Profile	Supported Destination IDs	Description
HC MHPD	`MHPD`	For postmarket reports being sent to the production gateway
HC MHPD	`MHPDVAL`	For postmarket reports being sent to the validation gateway
HC TPD	`TPD`	For clinical trial reports being sent to the production gateway
HC TPD	`TPDVAL`	For clinical trial reports being sent to the validation gateway

Once you set up the Health Canada Transmission Profiles, Vault uses the appropriate Transmission Profile to generate Submissions based on your Vault’s reporting rules for Health Canada.