SIST-TP CR 14302:2003

SLOVENSKI STANDARD
01-oktober-2003
=GUDYVWYHQDLQIRUPDWLND±2NYLUQHGRORþEHRYDUQRVWQLK]DKWHYDK]DQDSUDYHNL
QLVRSULNOMXþHQHVWDOQR
Health informatics - Framework for security requirements for intermittently connected
devices
Ta slovenski standard je istoveten z: CR 14302:2002
ICS:
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

CEN REPORT
CR 14302
RAPPORT CEN
CEN BERICHT
January 2002
ICS
English version
Health informatics - Framework for security requirements for
intermittently connected devices
This CEN Report was approved by CEN on 14 December 2001. It has been drawn up by the Technical Committee CEN/TC 251.
CEN members are the national standards bodies of Austria, Belgium, Czech Republic, Denmark, Finland, France, Germany, Greece,
Iceland, Ireland, Italy, Luxembourg, Malta, Netherlands, Norway, Portugal, Spain, Sweden, Switzerland and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: rue de Stassart, 36  B-1050 Brussels
© 2002 CEN All rights of exploitation in any form and by any means reserved Ref. No. CR 14302:2002 E
worldwide for CEN national Members.

CONTENTS
FOREWORD . 3
INTRODUCTION. 3
1. SCOPE . 4
2. NORMATIVE REFERENCES. 5
3. DEFINITIONS . 5
4. THE VARIETY OF SYSTEMS FOR INTERMITTENTLY CONNECTED DEVICES. 6
5. THE MAJOR ACTORS INVOLVED AND THEIR INTERESTS . 7
6. INTERACTING WITH CARDS . 8
7. ETHICAL AND LEGAL CONSIDERATIONS. 10
7.1 ETHICAL STATEMENTS .10
7.2 LEGISLATION ON HEALTH CARE DATA AND CARDS. 11
7.3 SOME BASIC PRINCIPLES FOR MEDICAL RECORDS. 12
7.4 RECOMMENDATIONS FOR CARD USE . 12
8. THE SECURITY SERVICES AND THE MEANS TO IMPLEMENT THEM. 14
8.1 CONFIDENTIALITY. 14
8.1.1 Physical card protection is not enough . 14
8.1.2 Data Object protection versus Device and Session protection. 15
8.1.3 Tamper protection of the card. 16
8.1.4 Access Control. 17
8.1.5 Cryptographic authentication . 17
Public key cryptography. 18
8.1.6 Defining classes of health care professionals is the issue . 20
8.1.7 Access conditions and functions. 21
8.1.8 Methods for card holder verification. 22
8.2 INTEGRITY AND QUALITY OF THE DATA. 22
8.2.1 Problems of a complicated data structure. 23
8.2.2 Unalterable. 23
8.3 AVAILABILITY. 25
9. THE PATIENT CARD AND TELEMATICS . 26
9.1 PATIENT CARDS AND ENCRYPTED TRANSFER OF RECORDS. 26
9. 2 PATIENT CARDS AND REMOTE PROOF OF CONSENT. 26
10. HEALTHCARE PROFESSIONAL CARDS.27
11. ISSUES OF INTERNATIONAL FUNCTION OF SECURITY MECHANISMS. 28
11.1 TRUSTED THIRD PARTY SERVICES . 28
11.2 RESTRICTIONS ON THE USE OF ENCRYPTION. 29
GLOSSARY . 30
Foreword
This CEN Report was prepared by CEN/TC 251 Health Informatics, the secretariat of which is held
by SIS – Swedish Standards Institute.
This work is based on several years of discussions on various documents in CEN/ TC 251/ WG 7 and
WG 6 and CEN TC 224/WG 12 . In particular, the work of TC251/PT 7-009 that drafted the ENV
12018 ” Medical Informatics - Identification, Administrative, and common Clinical Data structure for
Intermittently Connected Devices used in Health Care (including machine readable cards)” should be
acknowledged. Many of the concepts explained in this report are in fact underlying the security
objects defined in that standard.
This CEN Report is also based on work carried out within the following CEC projects:
CEC - AIM Eurocards Concerted Action on Extending the use of Patient Data Cards: The Security
Report and Assessment of Health Care Professional Card.
CEC - INFOSEC '94 programme on Electronic Signature and Trusted Third Party Services: Trusted
Health Information Systems: Part 1. Requirements on Electronic Signature Services and Part 2.
Trusted Third Party Services, published by Spri, Swedish Institute for Health Services Development,
Stockholm 1995.
CEC – Health Telematics project TrustHealth 1. Deliverable 2.1 Selection of Security Services and
Interfaces.
Introduction
Intermittently connected devices such as patient cards may carry important clinical information as
well as administrative data of importance to health care delivery. The information regarding an
identifiable individual is always sensitive and with clinical data it is particularly important to provide
appropriate means to ensure the protection of confidentiality. In addition several other security
services must be ensured to protect the patient safety as well as accountability of the professionals
responsible for recording data and reading data from intermittently connected devices.
Health care person devices, particularly microprocessor cards, carried by professionals and other
persons working in the health care sector, may play an important role in the provision of security for
all health information systems for the following core functions; to provide a secure user
authentication, to provide a digital signature mechanism and as a means to carry cryptographic keys
for confidentiality protection of stored and communicated health care information. The authentication
function may serve as a key to protected data on a Patient data card.
1. Scope
This CEN Report is aimed at providing a basis for a planned European Standard on the same subject,
work item Security Requirements for Intermittently Connected Devices. The reason for processing
this document as a formal CEN Report is that it has been requested as immediate guidance to the
current work of CEN TC224/WG12 in its preparation of standards specifying the mechanisms for
implementing security requirements in systems using machine readable cards in health care. The
scope of this report is also to serve as guidance, without being normative, to the many large projects
using cards in health care for both patients, professionals and other persons working in the health care
sector, presently under development in Europe.
This report defines a framework of security requirements in systems with intermittently connected
devices and discusses requirements for the following security services for ICD-systems:
Data Integrity protection
Data Origin and Entity Authentication
Access Control
Confidentiality protection
The report defines security requirements on the ICD-interchange interface between an application
system and an ICD-System. However, the overall security requirements can only be met if certain
requirements on the devices themselves are also followed.
Requirements for establishment of secure sessions with various types of ICDs as well as object related
security services are defined.
The report particularly defines how access to different types of data on intermittently connected
devices could be restricted to different classes of health care persons (professionals and other types of
personnel) or to the patients, especially when multinational access should be allowed. The rights to
read, add, change and delete must be defined separately.
The security policies proposed should also guarantee the authenticity of identification, administrative
and clinical information that may have important implications.
This report gives detailed security requirements for active devices such as microprocessor cards,
which are the only possibilities to implement some of the proposed services. The report also gives
important advice for passive devices such as magnetic stripe card systems or floppy disks. The major
focus is on systems for handling sensitive medical information on devices (mainly cards) held by
patients. However, some requirements on ICDs to be used by health care persons (professionals and
others) are also given. Detailed protocols for interaction between such devices and general medical
information systems for the purpose of secure user identification will be developed within a separate
work item.
2. Normative references
This CEN report incorporates by dated or undated reference, provisions from other publications.
These normative references are cited at the appropriate places in the text and the publications are
listed hereafter. For dated references, subsequent amendments to or revisions of any one of these
publications apply to this standard only when incorporated in it by amendment or revision. For
undated references the latest edition of the publication applies.
ISO 7498-2:1989 Information processing systems - Open systems interconnection Basic
reference model - Part 2: Security architecture.
ISO/IEC 9594-8:1990 Information technology - Open Systems interconnection: The Directory - Part
8: Authentication framework.
ISO/IEC 9798-1:1991 Information technology - Security techniques - Entity authentication
mechanisms - Part 1: General model
ISO/IEC 9796: 1991 Information technology - Open systems interconnection - Digital signature
scheme giving message recovery
ENV 12388: 1996 Medical Informatics – Algorithm for Digital Signature Services
ENV 12018: 1996 Medical Informatics - Identification, Administrative, and common Clinical
Data structure for Intermittently Connected Devices used in Health Care
(including machine readable cards)
3. Definitions
This CEN Report does not introduce any new normative definitions. Please refer to the Glossary in
the end of this document for definitions of commonly used security terms.
4. The variety of systems for intermittently connected
devices
Intermittently connected devices may be used for many different applications and the security issues
will vary accordingly. Patient data cards and cards held by health care professionals and other types of
personnel have attracted particular attention in recent years. For the purpose of this report we are
pointing at some of the differences with regard to administrative and medical uses of patient data
cards. However, it is frequently impracticable to draw a sharp line between these applications. This
report is an analysis of the security issues that arise with patient data cards and possible solutions.
With a few exceptions it does not give recommendations that apply to all patient card systems. The
flexible introduction of standardised security countermeasures based on the needs of the specific
application is emphasised. The combination of medical data with non health care related applications
have been suggested but the security problems involved makes it very difficult to implement.
Aspect Administrative use Medical use
Overall obj
...