Remote desktop for hospitals
Remote desktop for hospitals, clinics and labs
For the IT team that supports wards, a lab and clinics from one room. Nelkira reaches a workstation by its nine-digit number, through the firewall you already have, and leaves a record there of what was done.
Built for the network a hospital actually has
A connection tries the local network and a relay at the same time and keeps whichever answers first. A support PC and a ward workstation on the same subnet normally talk straight to each other where Windows Firewall allows it, and the session stays on the site; the relay still hears about the call while it is set up. Where a firewall refuses a direct path, the session goes through a relay on port 443. That is the same port web browsing uses, so it works wherever a browser does. Nothing needs a public address or a forwarded port.
The directory, the relay and every session’s record run on servers you control, in the country you choose. Your own relay is one command on a Linux box. An app that has never reached nelkira.com is never held back by it: a machine on an isolated network is a use the product exists for.
What the record makes possible for your IT policy
Every workstation keeps its own record. It notes when a session started, how it was authorised and when it ended. It names files taken or placed, counts clipboard transfers by size, and logs screen switches, Ctrl+Alt+Del and the times the screen was blanked. Failed attempts are limited and written to the record too.
The record lives on the machine that was accessed, not on the engineer’s laptop. It contains no content: no clipboard text, no file contents, no keystrokes, no screenshots. A log holding what was on a clinician’s clipboard would be a patient-data breach wearing the clothes of an audit trail.
For a policy, that makes a few things possible. You can answer who was on a workstation and when, and which files left it, by name. You can show that the tool never stored the content of a session. Not yet done: the record is a plain file, not tamper-evident, and anyone with a Windows account on that machine can alter or delete it (from release 0.5.0, on a workstation set up for access when nobody is there, only administrators can).
Privacy at the workstation
The other side is shown it
While a session is open, an amber ‘Screen shared’ pill sits at the bottom right of the screen, except on Windows’ lock, sign-in, Ctrl+Alt+Del and administrator-prompt screens. The machine’s own Nelkira window says one person is connected.
Privacy screen is for the corridor
Blanking the screen hides a session from people walking past. It blocks local input only where Nelkira runs with administrator rights or, from release 0.5.0, on a PC set up for access when nobody is there. It is not a way to hide from the machine’s own user; the acceptable use policy forbids that.
View only
Look at a problem without touching anything. The person at the desk keeps control.
Allow, or a password
Every workstation shows an access password; type it and you are straight in. Leave it blank and the person at the desk is asked; with no answer in 60 seconds, the connection is turned away. Either way, on a workstation installed for use while someone is here (Setup’s default), someone must be signed in to Windows there, with Nelkira running; from release 0.5.0 an administrator can set a workstation up for access when nobody is there.
Who gets in, and how a session is protected
The two machines agree a key with each other, fresh for every session (a P-256 exchange), and everything after that is sealed with AES-256-GCM. A relay copies encrypted bytes it holds no key for, including relays we operate. Where a password protects the connection, the viewer proves it saw the same two keys, and the workstation checks that proof before it lets anyone in.
Remembered devices are revocable tokens, not stored passwords; forgetting remembered devices on the workstation (all at once, from the Advanced tab) invalidates their tokens. From release 0.4.1 a workstation makes a new access password each time Nelkira starts (unless a fixed one is set), and a new password does not forget remembered devices. Three limits, said plainly. From release 0.4.0 the password is proved, not sent (SPAKE2, RFC 9382). A viewer older than 0.4.0 still sends it, inside the encrypted channel, to whichever machine answers the number, so a sign-in from such a viewer through a hostile relay is not protected against impersonation; a 0.4.0 viewer asks for Allow instead of sending it to an older workstation. From 1 May 2027 a workstation on 0.4.0 or newer accepts a password only from 0.4.0 or newer viewers (older ones still connect when the person there clicks Allow). And a connection approved by clicking Allow with no password is encrypted but not proof against an active attacker in the relay path. And where Nelkira is installed for use while someone is here (Setup’s default), anyone with another Windows account on a workstation can read and change its remembered devices, registration token and, from 0.4.0, its device key, and its access password before release 0.4.1 (from 0.4.1 the password Nelkira makes is kept only in memory); on a workstation set up for access when nobody is there, only administrators and Windows itself can open them, though a fixed Agent__AccessPassword stays readable by every account that can read where it is set.
For the person who has to sign off
We claim no certification: no ISO 27001, no SOC 2, no HIPAA attestation, and no third-party audit or penetration test so far. The installer is not code-signed, so Windows SmartScreen asks before it runs; check the SHA-256 on the download page.
We do not say that any law or regulation is met by installing Nelkira. We say what the software does and does not do, so a policy can be written against facts; the full list is the security statement.
Most incidents with remote access software are somebody talked into giving out their number and password by telephone. Tell staff that nobody legitimate will ring and ask for those.
Questions hospital IT asks
Will it work through the hospital firewall?
That is what the relay is for. Where a firewall refuses a direct path, the session goes through a relay on port 443. Two PCs on the same subnet still talk straight to each other where Windows Firewall allows it.
Can patient data end up in the session record?
The record never holds clipboard text, file contents, keystrokes or screenshots. It does hold the names of files that moved, so name files with that in mind.
What does it cost a hospital?
Nothing today: no device limit, no session timer, no card. Paid plans for organisations are planned for 2028 and will be published on the pricing page well before anybody is asked to pay.
See also: free remote desktop software for Windows, remote support software for IT teams and MSPs, and Nelkira Go for a phone.