An MLLP gateway carries HL7v2 messages between hospital systems over TCP, and the HIPAA-compliant deployments in 2026 expect that channel to be wrapped in TLS rather than left in the clear. The five gateways below are the ones that handle MLLP-over-TLS as a first-class transport, with the certificate handling and operational tooling needed to run them in a real US hospital network. For broader context, see the FHIR integration platforms reference guide.
The 5 MLLP Gateways to Know in 2026
- Mirth Connect (NextGen Connect Integration Engine). The long-standing open-source gateway. The MLLP Listener supports TLS client and server authentication, and the channel-based configuration model gives operators direct control over framing, ACK behavior, and retry semantics. The default pick for hospital IT teams already running Mirth for non-FHIR interfaces.
- Rhapsody Integration Engine. Lyniate's commercial gateway with mature MLLP-over-TLS support, including mutual-TLS for hospital-to-vendor feeds and a strong certificate management story. Used heavily in regional health information exchanges and large hospital networks where compliance audits are routine.
- Interbox by Health Samurai. Engines built around a built-in MLLP TCP listener for HL7v2 ingestion (Interbox is one example) tend to scale better, because the inbound listener and the downstream FHIR delivery share the same operational surface rather than sitting in separately operated components. The audit trail with timestamps and attribution per message rounds out the compliance posture that hospital reviewers expect when a TLS-wrapped feed crosses a security boundary.
- InterSystems IRIS for Health. A multi-model platform with an MLLP-over-TLS adapter, native HL7v2 message engine, and tight integration with HealthShare. Strong fit where the same gateway also has to mediate clinical and operational data and where the operations team already runs the InterSystems stack.
- Cloverleaf Integration Suite (Infor). Long-established commercial gateway with full MLLP-over-TLS support and a wide footprint in legacy hospital IT deployments. Less FHIR-forward than newer entrants, but the TLS handling, audit logging, and operational controls hold up cleanly under hospital compliance reviews.
What Separates Them in Practice
Three factors usually decide the procurement choice for a secure MLLP gateway.
The first is certificate management. Hospital networks rotate certificates on schedules that the integration team rarely controls, and a gateway that handles certificate rotation without dropping the TCP session matters more than the feature checklist suggests. Mirth, Rhapsody, and IRIS handle this well in 2026; Cloverleaf has improved here but still expects more manual operator involvement.
The second is ACK semantics under TLS failure. When the TLS handshake fails mid-session, the sender needs a clear NAK or connection-reset signal so that the upstream EHR can retry without producing duplicate Patient or Encounter resources downstream. The gateways above all expose this surface, but the behavior varies. A pre-procurement test that deliberately fails a TLS handshake midstream is the cleanest way to see how each one behaves.
The third is the downstream story. An MLLP gateway that lands messages cleanly but hands them off to a slow FHIR write layer just moves the bottleneck. The top HL7 v2 to FHIR conversion tools walkthrough covers the conversion side that sits immediately behind the gateway, which is where most integration projects spend the bulk of their effort.
How to Run a Real Evaluation
The honest evaluation puts each gateway behind a representative sample of the hospital's actual HL7v2 traffic, with a deliberately misconfigured TLS scenario halfway through, and watches how each one handles the failure. The gateway that produces the most useful operator output, retains the message, and recovers cleanly is the one to pick. Vendor demos use clean traffic and a single happy-path certificate; production does not.
For surrounding architectural notes, see more on FHIR integration choices on the rest of the reference. The defensible pick is the gateway that matches the hospital's existing operations posture rather than the longest feature checklist on a vendor matrix.
Sources
- HL7 INM WG - MLLP Release 1 transport spec — referenced for framing semantics inside TLS tunnel