Why Collabora Online for healthcare organisations starts with patient data location
Where the document editor runs decides who can reach patient data. Clinical letters, discharge summaries, consent forms and administrative files move through shared platforms every day, and in many health services the editing step happens in a third-party cloud service that the organisation does not operate. Collabora Online is a self-hosted option: it runs inside your own cloud accounts, data centres or restricted networks as a WOPI editor, and a host such as Nextcloud opens documents in it through the WOPI protocol. DeployOpen plans, deploys and supports that stack in the infrastructure you choose, so the document content is processed where your existing controls already apply.
For IT teams, the change is architectural. They own the Collabora servers, the TLS certificates, the reverse proxy and the WOPI allow list, and they need to confirm which host is allowed to call the editor and from which addresses. For privacy and information governance teams, the question shifts from a vendor's data processing terms to a concrete data flow: which systems hold the file, which process renders it, and where logs and temporary files are written. For clinical and administrative leads, the practical change is who can open and edit a record. Nextcloud Office allows administrators to limit which groups can use the editor and which can edit rather than only view, so access rules can follow care team membership instead of a flat share.
This page covers HIPAA and GDPR context as it applies to these decisions, but it does not claim certification. HHS states that no HIPAA Security Rule standard requires certification, and an organisation cannot be certified as HIPAA compliant. Ask your compliance lead to map the Collabora Online deployment against the covered entity's or business associate's own risk analysis, and confirm the data location, retention and access rules with your privacy office before the pilot begins.
Which healthcare requirements shape the Collabora Online build
This table maps each healthcare requirement in scope to what it asks for and what it means for a Collabora Online build, including WOPI allow lists, TLS, access groups and incident reporting. Read each row as a design input to settle before rollout, and confirm the final interpretation with your privacy, compliance and legal teams.
| Requirement | What it asks for | What it means for the Collabora Online build |
|---|---|---|
| HIPAA Security Rule scope (45 CFR 164.302) | Covers electronic protected health information (ePHI) held or transmitted by covered entities and their business associates | Any document that contains ePHI and passes through Collabora Online falls in scope. Confirm which hosts, file stores and users touch those documents before setting access rules. |
| Addressable encryption specifications (Appendix A to Subpart C) | Encryption is addressable, so you must assess it, then either implement it or document an equivalent measure | Terminate TLS on every hop between browser, WOPI host and Collabora server, and record the decision. Keep the Collabora server URL on the same protocol as the host, preferably HTTPS, as the Nextcloud manual recommends. |
| Addressable automatic logoff (Appendix A to Subpart C) | Electronic sessions should end after inactivity where that is reasonable and appropriate | Align session lifetimes between the WOPI host and the editing session. Confirm how the host expires access tokens and whether closing a document ends the editing session. |
| Unique user identification (Appendix A to Subpart C) | Required: each user is identified uniquely before access to ePHI | Editing should run under the host's identity, not shared accounts. Check that document access tokens map to a named user so audit trails stay attributable. |
| Business associate contract terms (45 CFR 164.314(a)(2)(i)) | Vendors must follow the Security Rule, flow terms to subcontractors that handle ePHI and report incidents | If a partner operates or supports the deployment, the contract must cover access to ePHI and incident reporting. Confirm subcontractors, such as hosting providers, before data flows through them. |
| WOPI allow lists and access groups (GDPR Articles 32 and 34, as shown by the CNIL fine) | Appropriate security and access control. The CNIL fined Hopital Prive de la Loire EUR 500,000 on 3 September 2026 for external access without VPN or multi-factor authentication and for access ignoring the care team's need to know | Restrict WOPI requests to the host's known addresses. Limit editing rights by group, not just viewing, so only care team members with a need to know can edit clinical documents. Require VPN or multi-factor authentication for any remote access path. |
| NIS2 Annex I health sector (Directive (EU) 2022/2555) | Lists health care providers and medical device manufacturers among high-criticality sectors | If your organisation falls in scope, document editing services become part of your security obligations. Confirm national transposition and reporting duties with counsel before setting incident workflows. |
| Electronic records and signatures (21 CFR Part 11) | Controls on electronic records and signatures where regulated records are kept in FDA-regulated work | Where Collabora Online edits regulated records, confirm whether Part 11 applies. Plan audit trails, version control and access controls with the quality team before validation work starts. |
How Collabora Online handles documents that contain patient information
The WOPI host authorises the user, and Collabora Online never decides who may open a document. In a typical setup, Nextcloud or another WOPI host checks the user's session and permissions, then gives the browser a short-lived access token and a WOPI source URL that points back to the file. The browser loads the editor from the Collabora Online server, which fetches the document from the host, renders it and sends edits back through the host. This means access control for patient records sits in the host application, while Collabora Online is the component that holds a copy of the document in memory during the editing session. Before rollout, the healthcare team should map which groups can open and which can edit in the host, because Nextcloud lets administrators limit both the editor and edit rights by group, and the host, not the editor, is the place where a care team's need to know is enforced.
The Nextcloud administration manual recommends restricting WOPI requests to the IP addresses of the Collabora servers and using the same protocol, preferably HTTPS, for the Collabora server URL as for the Nextcloud installation. The reason is simple: the Collabora server should be reachable only from the hosts that are meant to use it, and the traffic between them should be encrypted end to end. Network policy, the reverse proxy and the WOPI allow list in the configuration should all reflect that same intent, and the team should test it by attempting a connection from an address outside the approved list. Dedicated hardening controls, such as proof keys and access token settings, are covered in the security hardening section.
Two review points belong to the compliance file. First, the Collabora Online server code is licensed under the Mozilla Public License 2.0 (MPL-2.0), so the team should confirm with its legal and procurement contacts that this licence works for its internal use and any modifications it makes. Second, the organisation must confirm where document data is stored, cached and logged: temporary files on the server, container volumes, reverse proxy access logs, and any AI assistant features that the administrator enables, which are off by default in Collabora Online 26.04 and can use an external provider. Each of these locations should be written down, covered by the business associate contract with the vendor or service provider where relevant, and included in retention and backup planning.
Choosing between Docker, system packages and Kubernetes for clinical networks
For a single hospital site, a clinic or a smaller health service with a limited number of editors, a Docker container or a system package on one Linux server is usually the simplest route. The free CODE image (collabora/code) is useful for testing, but Collabora describes CODE as not recommended for production, so a supported edition is the realistic option for clinical documents. Installation on one host keeps the number of moving parts low, and the team can run it alongside Nextcloud or another WOPI host on the same network segment.
- Package or container choice: System packages suit teams that already patch the operating system through standard tooling, while Docker suits teams that rebuild images through a controlled pipeline.
- Single point of failure: One server means one failure domain, so confirm the outage tolerance the service needs before the design is fixed.
- Reverse proxy and TLS: Place the server behind a reverse proxy with TLS, and match the protocol used by the WOPI host, as the Nextcloud administration manual recommends HTTPS.
- Patching effort: Someone must apply point releases on a fixed schedule, including security fixes, so assign that task explicitly.
- Restricting WOPI access: Limit WOPI requests to the addresses of the Collabora server.
Before committing, ask your vendor or partner which edition and support terms apply to clinical use and who receives security notices.
For a larger estate with many sites, several WOPI hosts or high editing concurrency, the official Helm chart runs Collabora Online on Kubernetes. The chart gives repeatable deployments, but it changes how scaling works. The chart README states that horizontal pod autoscaling is disabled because scaling breaks collaborative editing and copy and paste, so replica counts are set manually and changed through planned operations.
- Manual replicas: Set the replica count from measured demand and change it through change control rather than through an autoscaler.
- WOPISrc-aware routing: The load balancer must route by the
WOPISrcparameter so all users editing one document reach the same pod. Confirm this with your ingress controller. - Ingress support: The chart supports Nginx, HAProxy and OpenShift Router ingress, so select the controller your platform team already operates.
- Production resources: The chart recommends limits of 8 CPU cores and 8000 MiB of memory per pod, with requests of 4 cores and 6000 MiB. Treat these as the starting reference and validate them against your load.
- Cluster operations: Kubernetes upgrades, node patching and backups become part of the service's run cost.
Ask the platform team to show how a document session will be pinned to one pod during a rolling update.
Clinical networks often separate patient systems, clinician workstations and external access into distinct zones. The deployment model must fit those zones. A Collabora server that only needs to reach the WOPI host and browsers on the clinical side can often sit in a segment without internet access, provided that packages or images are mirrored internally. External access to patient record systems has drawn regulatory attention, so the design should avoid opening document editing to outside networks by default.
- Offline artefacts: Mirror system packages or container images into an internal registry or repository, and verify signatures before installation.
- Network paths: Document every allowed flow between the WOPI host, the Collabora server and the browsers, and block everything else.
- Segmentation for Kubernetes: Apply network policies so only the WOPI host and ingress can reach the pods.
- Access for remote staff: Route remote access through controlled entry points with strong authentication, not directly to the editor.
- Update path: Plan how security updates reach an isolated network, because offline updates add lead time.
Confirm with your security team which network zones the editor may cross before choosing a model.
Which Collabora Online and Nextcloud settings matter in healthcare
Healthcare teams that edit documents in the browser should treat the WOPI connection, the editor permissions and the update cadence as one control set. Each card below names a setting, the risk it addresses and what to confirm in your own environment before go-live.
WOPI host allow list
Restrict WOPI requests so that only your Nextcloud servers can reach the Collabora server. The Nextcloud administration manual recommends limiting WOPI requests to the IP addresses of the Collabora servers, which keeps document traffic on a known path. Confirm the allow list in both directions after every network change, and record who owns the list. A wrong or stale entry is the most common reason editing silently stops working.
HTTPS-only server URL
Use the same protocol for the Collabora server URL as for the Nextcloud installation, preferably HTTPS. Mixed protocols cause connection failures that staff may work around by copying files to personal storage, which is a patient data exposure. Check the URL in Nextcloud settings after any certificate or proxy change, and confirm that clinical networks do not downgrade traffic between the two hosts.
Group-based editor access
Nextcloud Office lets administrators limit which groups can use the editor and which groups can edit rather than only view. In healthcare this maps to the need-to-know rule: scheduling staff, billing teams and external auditors often need read access to a template but not write access to a clinical record. Build these groups from your identity source and review membership on the same cycle as your access reviews.
AI assistant kept off
Collabora Online 26.04 adds an optional AI assistant across Writer, Calc and Impress. It is off by default, and administrators choose the provider and whether it is hosted externally or on their own infrastructure. Keep it disabled unless your privacy office and security team have approved a provider, and confirm where prompts and document content would be sent before any pilot. Do not assume the assistant respects your group restrictions without testing.
Security advisory patch cadence
Collabora publishes security advisories for Collabora Online. The 25.04 release notes record that 25.04.7.5, released January 29, 2026, fixed CVE-2026-23623 and that package signing keys were updated for RPM and DEB users. Agree a written patch window with your vendor or internal team, subscribe to advisories, and confirm that the signing keys in your package repository match the published keys before each update.
Clinical template format testing
Clinical templates, forms and reports often rely on docx, xlsx and pptx files, PDFs and CSV exports with fields, styles or macros that a browser editor may render differently. Build a test set from real templates with no patient data, and compare output before and after rollout for layout, tables, headers, fonts and embedded content. Record which formats staff may edit in the browser and which must stay in a desktop application or a controlled workflow.
Where licence cost reduction comes from and where it does not
Licence cost reduction comes from the office suite licence, not from the total cost of running the service. Collabora Online server code is licensed under the Mozilla Public License 2.0, and the free CODE edition is released roughly once a month as a rolling release. Collabora describes CODE as suited to testing, home use or small teams and not recommended for production, so a hospital that wants a clinical document service on CODE takes on the support, patching and change risk itself. The paid Business plan costs 3 euros per user per month for up to 99 users, according to the Collabora pricing page, and includes long term support, a service level agreement, signed security updates and customer portal access. Enterprise pricing for 100 or more users is quoted with volume discounts and adds integration support and customization services. Compare these figures against your current per-seat office licences, but only after you have confirmed the user count that will actually edit documents in the browser.
Some costs are one-time and some recur. One-time work includes the reference design, the hosting build in your own infrastructure, identity and WOPI host integration with your records or document management system, and testing of clinical templates, forms and line-of-business exports against real documents. Recurring costs include the subscription, the staff time to apply point releases and monitor the service, backups, certificate renewal, and the periodic re-test of templates after each upgrade. Hosting capacity is a separate line that rises with concurrent editors. Ask any provider to split the quote into these lines, state who pays for each, and say whether the subscription is priced per named user or per concurrent use.
When you request a quote, ask for the written scope before any price: which templates and formats are tested, which WOPI hosts are covered, whether integration support and customization are included, the support hours and response commitments that come with the subscription, and how security updates reach your environment. Confirm with Collabora whether the Business plan terms match your user count and whether the Enterprise terms apply at your size. Also ask who maintains the template test results after each release. A lower licence line does not reduce cost if clinical staff lose formatting in a discharge letter, so budget the testing and the staff time that the subscription does not cover.
How a healthcare rollout runs from pilot to clinical use
The sequence moves Collabora Online from a scoped decision to a monitored clinical service, with each phase closing on a written output that privacy, clinical and IT leads can sign off. Durations depend on the agreed written scope and are not set by this page.
Scope the deployment with privacy and clinical leads
Start by agreeing which document types are in scope, such as discharge letters, referral letters, consent forms, clinical protocols and administrative spreadsheets, and which systems will open them. Privacy, information security, clinical governance and the IT team sign the scope together, and DeployOpen turns it into a written scope with deliverables and timelines. The step is done when the scope names the WOPI host (for example, Nextcloud or another document platform), the hosting location, the user groups and the data classes that will pass through the editor.
Test templates and line-of-business compatibility
Collect the real clinical templates, letterheads, forms with content controls, and any spreadsheets that feed line-of-business systems, then open and save each one in the test environment. Check layout, fields, tracked changes, macros, embedded images, fonts and PDF export against the originals in Microsoft Office. The output is a fidelity log that lists each template, the result, and the fixes or accepted differences, which clinical owners approve before the pilot begins.
Run a pilot in a non-clinical team
Choose a team that handles internal documents rather than patient records, such as facilities, HR or quality administration, and let it use Collabora Online for normal work for a defined period agreed in the scope. Track login problems, save conflicts, slow sessions and missing functions in a shared issue list. The pilot closes when the issue list has no open items that block daily use and the team lead confirms in writing that the workflow is ready to repeat.
Design access groups before any clinical use
Map roles to two separate permissions: who may open the editor at all, and who may edit rather than only view. Nextcloud Office allows administrators to limit both by group, so align these groups with clinical and administrative roles and with the need-to-know rules that the privacy lead sets. The output is an access matrix that names each group, its editing rights and its owner, and that is tested with sample accounts before real records are opened.
Complete the security review and processor terms
Review the deployment against the HIPAA Security Rule for organizations under US jurisdiction, or the relevant data protection regime elsewhere, and map each control to evidence: TLS on the Collabora server URL, restricted WOPI sources, authentication, logging, patch process and backup. In parallel, the legal team checks the business associate contract or processor terms with any vendor or partner that will touch ePHI, including the flow-down to subcontractors and incident reporting duties. The step closes with a signed review record and a list of residual risks accepted by an owner.
Roll out in stages by department
Enable the editor for one clinical or administrative department at a time, starting with departments whose documents are least sensitive and ending with those that handle the most patient-facing material. Before each wave, confirm the access groups, brief the users on where to find the editor and what to do when a document fails, and keep the previous workflow available for a fallback period. Each wave closes when support requests have settled and the department has confirmed that its templates work as expected.
Monitor and patch in run state
Once the service is in clinical use, operations staff monitor availability, errors, WOPI connection failures and resource use, and review access group changes on a set schedule. Security advisories and point releases are applied through a tested change process, and each update is re-checked against the template fidelity log before it reaches clinical users. The step is ongoing, and the owner should confirm with Collabora and DeployOpen the support option, patch cadence and retainer terms in the written scope.
What compliance frameworks expect from a document editor
Healthcare organisations rarely face a single rule for document editing. The HIPAA Security Rule, its pending revision, optional third-party assessments and European obligations each shape what evidence a Collabora Online deployment must produce. Read them together, then decide which ones bind your organisation.
HIPAA Security Rule without certification
The Security Rule applies to covered entities and business associates for all electronic protected health information they handle, and a document editor that touches patient records falls inside that scope. There is no HIPAA certificate to obtain. HHS states that private certifications do not prevent a later finding of violation, so the evidence you need is your own risk analysis, access controls and documentation of how Collabora Online handles ePHI. Confirm with counsel whether your vendor relationships require a business associate contract.
OCR audits on hacking and ransomware
The HHS Office for Civil Rights enforces the Security Rule through complaints, compliance reviews and audits. Its 2024 to 2025 audits review 50 covered entities and business associates against the provisions most relevant to hacking and ransomware. For a document editor, expect questions on who can open which documents, how sessions are authenticated, how the WOPI host is restricted and how patches are applied. Prepare a current record for each of these.
Proposed Security Rule revision
HHS proposed a major Security Rule revision on 6 January 2025. As of October 2026 no final rule has been published, and the Unified Agenda projects final action for July 2027. Plan against the current rule while tracking the proposal, since its requirements would likely raise the bar for access management, asset inventory and encryption. Ask your Collabora Online partner how controls would be evidenced if the final text changes.
HITRUST as optional assessment
HITRUST CSF is a third-party assessment framework, not a legal requirement. Its e1 and i1 certifications last one year and r2 certifications two years. Some customers and partners ask for it, so check whether a contract requires it before committing budget. Any report must come from an authorised HITRUST assessor. DeployOpen prepares controls and evidence but does not issue HITRUST reports.
NIST SP 800-66 Rev. 2 as guidance
NIST SP 800-66 Rev. 2, published in February 2024, is a resource guide for implementing the Security Rule. It lists key activities and sample questions for every standard. HHS treats it as informational rather than binding. Use it as a checklist to map Collabora Online settings, logs and administrative procedures to Security Rule standards, and keep the mapping in your documentation.
GDPR and NIS2 for European providers
European healthcare providers face GDPR Article 32 security duties and, under NIS2 Annex I, health is a sector of high criticality. A regulator fined a French hospital EUR 500,000 in September 2026 for external access without VPN or multi-factor authentication and for access control that ignored need to know. Map document access to care-team roles, and confirm with your data protection officer how Collabora Online hosting and logs fit your processing records.
What healthcare teams ask before implementing Collabora Online
What drives the cost of implementing Collabora Online in a healthcare organisation?
The cost is driven by scope, not by a list price. Collabora Online server code is licensed under MPL-2.0, so the software itself carries no licence fee, but the work to deploy it does have a cost. The main components are infrastructure (servers or Kubernetes capacity in your environment), integration with your document platform such as Nextcloud, identity and access setup, testing of clinical templates and line-of-business integrations, and ongoing operations. If you use a subscription, the Business plan is listed at 3 euros per user per month for up to 99 users, according to the Collabora pricing page, and that recurs. Ask any quote to separate one-time engineering from recurring subscription and support fees, and to state which compliance evidence is included.
How long does a Collabora Online implementation take in a hospital environment?
The timeline depends on how many document platforms, user groups and templates are in scope, and on how much testing your clinical documents need. Hospitals usually add time for change control, security review, template fidelity checks and staged pilots by department. Sizing also matters: Collabora's Helm chart README says horizontal autoscaling is disabled because scaling breaks collaborative editing, so replica counts are set manually and load balancers must route by WOPISrc. Agree a written scope and milestones before work starts, and ask for a timeline tied to those deliverables rather than a generic duration.
Can our internal team implement Collabora Online without an outside partner?
Yes, many teams do, provided they have Linux or Kubernetes operations skills, reverse proxy and TLS experience, and someone who owns identity integration and the document platform. Collabora Online can be deployed from Docker images, system packages or on Kubernetes. The harder parts for healthcare are usually the security configuration, WOPI host restrictions, template fidelity testing and producing evidence for your privacy and security reviews. Assess your team against those tasks honestly. A fixed-scope engagement can cover only the parts you choose, and DeployOpen works inside your own infrastructure, so ownership of the running system stays with you.
What must our organisation provide before an implementation starts?
Expect to provide a named technical owner, access to the target infrastructure or cloud account, the document platform you will connect (for example Nextcloud), an identity source, TLS certificates and DNS names, and a sample set of clinical and administrative templates for fidelity testing. You will also need a decision on who approves access groups, since Nextcloud Office lets administrators limit which groups can use the editor and which can edit rather than only view. Security and privacy staff should be available for the data flow review, and change approval windows should be known in advance. Confirm each item in the written scope.
Do we need a business associate agreement if Collabora Online is hosted by a third party?
If a third party hosts, operates or supports a system that creates, receives, maintains or transmits electronic protected health information for you, that party is generally a business associate, and the HIPAA Security Rule requires a business associate contract. Under 45 CFR 164.314(a)(2)(i), the contract must require the business associate to comply with the Security Rule, flow the same terms to subcontractors that handle ePHI, and report security incidents to you. Whether self-hosting inside your own environment changes this depends on who can access the data. Get legal advice on your specific arrangement and confirm the contract terms with each provider, including any DeployOpen engagement that touches your systems.
Is there a HIPAA certification for Collabora Online or for our deployment?
No. There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance, that HHS does not endorse or recognise private certifications, and that such certifications do not stop HHS from later finding a violation, according to HHS FAQ 2003. HHS Office for Civil Rights enforces the rule through complaint investigations, compliance reviews and audits. Be cautious with any vendor or consultant who claims a HIPAA certificate. Evidence that your deployment meets the Security Rule comes from your own risk analysis, documented safeguards and the independent assessment you choose to commission.
What is the cost of getting HIPAA wrong for a healthcare provider?
Penalties are set per violation and are inflation-adjusted. For penalties assessed on or after 28 January 2026, the range is $145 per violation to $2,190,294 per violation, with a calendar-year cap of $2,190,294, according to 45 CFR 102.3. The HHS proposed Security Rule revision of 6 January 2025 (90 FR 898) is not yet final, and the Unified Agenda projects final action for July 2027, so confirm current requirements before you finalise your design. Ask your counsel which rule versions apply to your organisation and document the risk analysis that informs your choices.
What to ask a partner before signing a healthcare scope
Before you sign, ask the partner to put the answers in the scope document, because the HIPAA Security Rule (45 CFR Part 164 Subpart C) applies to electronic protected health information (ePHI) wherever it is created, received, maintained or transmitted. Ask how ePHI handling is designed in the Collabora Online deployment: which components see document content (the WOPI host, the Collabora Online server, the reverse proxy and any AI assistant if you enable it), where temporary files and caches are written, how they are cleared, and what the access and audit logs record. Ask whether logs can contain document names or identifiers, who can read them, and how long they are kept. Confirm that each control is mapped to a specific implementation specification in Appendix A to Subpart C, and ask how addressable specifications are assessed and documented under 45 CFR 164.306(d).
Ask for a written data flow diagram and a list of every sub-processor that touches the system, including hosting providers, backup services, monitoring tools and any external AI provider. The scope should state who patches Collabora Online and the host platform, how security advisories are tracked and in what time frame patches are applied, and who signs off a change. Ask how the partner learns of new advisories from Collabora and how it tells you about them. For the subscription, confirm terms directly with Collabora, including what the Business or Enterprise plan covers for signed security updates, long-term support and service levels, because those terms decide how patching and support are sourced. Ask what the handover includes: runbooks, configuration records, backup and restore evidence, and named owners after the project ends.
Finally, ask how the partner handles the business associate flow-down. Under 45 CFR 164.314(a)(2)(i), a business associate contract must require the business associate to comply with the Security Rule, pass the same terms to subcontractors that handle ePHI, and report security incidents to the covered entity. Ask whether the partner will sign a business associate agreement if its staff can access ePHI, and whether its subcontractors have signed matching terms. Note that no HIPAA certification exists, so a partner that offers one should be asked to explain what it actually evidences. Ask for a named contact and a deadline for incident reports so your breach assessment can start on time.
How DeployOpen scopes and delivers healthcare document editing
This sequence takes a healthcare organisation from a written scope to a Collabora Online editing service running in its own infrastructure, tested on the editing path and handed over with the evidence a compliance review will ask for. Each step closes with an agreed output so the client can check progress before the next one starts.
Confirm the data flows and document types
DeployOpen and the client's security, clinical IT and compliance leads map which documents are edited, which host platform calls Collabora Online (for example Nextcloud), which user groups need edit rights, and where electronic protected health information could appear in files, logs or temporary storage. The output is a written data flow map and a list of document types checked against the formats Collabora Online supports, with gaps flagged for testing. Clinical templates that depend on macros or specific Microsoft Office features are recorded as open items.
Agree the fixed-scope statement of work
Before any build work, DeployOpen and the client agree the scope, deliverables, responsibilities and timelines in writing. The statement of work separates what DeployOpen installs, configures and documents from what the client provides, such as hosting accounts, DNS, TLS certificates, identity integration and sign-off from clinical users. The output is a signed scope that a procurement team can compare directly with its own team's estimate. The quote follows from this written scope, not from a standard price list.
Build the deployment in client infrastructure
DeployOpen installs Collabora Online in the client's own cloud accounts, data centre or restricted network, using the deployment method the scope selects. Work covers the reverse proxy, TLS, the allow list of WOPI hosts, the group restrictions on editing in the host platform, and the storage and logging settings that keep documents inside the client's boundary. The output is a configuration record and a working staging environment that the client's team can inspect and reproduce.
Test the editing path and document fidelity
DeployOpen runs security testing against the editing path, including the WOPI endpoints, authentication between the host and the editor, access control checks for users outside the care team, and exposure of documents in logs or caches. Clinical staff test the agreed document set for layout, templates and data fidelity. The output is a findings report with severity ratings and a retest of anything fixed before go-live. Findings that the client accepts as residual risk are recorded with the reason.
Prepare compliance evidence without certifying
DeployOpen assembles the technical records that a compliance assessment will ask for, such as access control settings, encryption configuration, audit logging, backup and restore procedures, and documented decisions on addressable safeguards. The client's compliance lead maps these to its own control set. DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and certification bodies make those determinations, so the output is an evidence pack and a gap list that the client can take to its assessor.
Hand over runbooks and train operators
DeployOpen delivers runbooks covering patch and update steps, backup and restore, monitoring, incident handling and how to add or remove user groups. Operators from the client's team run at least one supervised patch cycle or restore test during the handover so that they can perform the work without DeployOpen present. The output is a signed handover checklist and a list of items the client's team now owns, separated from items covered by retainer.
Move to a retainer for patching and upgrades
Once the service is live, the client can choose a retainer for ongoing security patching, version upgrades and periodic re-testing of the editing path. The retainer scope, response expectations and review cadence are written into a separate agreement. Collabora's subscription tiers, including the Business plan and support terms on Collabora's pricing page, are a separate purchase that the client makes directly, so the retainer quote should state which items it does and does not cover.
