SIST EN 12251:2005
(Main)Health informatics - Secure User Identification for Health Care - Management and Security of Authentication by Passwords
Health informatics - Secure User Identification for Health Care - Management and Security of Authentication by Passwords
This document is designed to improve the authentication of individual users of health care IT systems, by strengthening the automatic software procedures associated with the management of user identifiers and passwords, without resorting to additional hardware facilities.
This document applies to all information systems (hereafter called systems) within the health care environment that handle or store sensitive person identifiable health information, using passwords as the only means of authenticating the entered user identifier, i.e., verifying the claimed identity of a user. Systems that fall within the scope of this document include for example electronic patient record systems, patient administrative systems and laboratory systems, containing personal health information.
This document does not apply to systems outside the health care environment. Neither does it apply to systems within the health care environment that use other means of identification and authentication, such as smart cards, biometric methods or other technical facilities.
Medizinische Informatik - Sichere Nutzeridentifikation im Gesundheitswesen - Management und Sicherheit für die Authentifizierung durch Passwörter
Informatique de santé - Sécurité de l'identification de l'utilisateur des soins de santé - Gestion et sécurité de l'authentification des mots de passe
Zdravstvena informatika – Varna identifikacija uporabnikov v zdravstvenem varstvu – Upravljanje in varnost avtentikacije z gesli
General Information
Relations
Overview
EN 12251:2004 - published by CEN - is a European health informatics standard titled Health informatics - Secure User Identification for Health Care - Management and Security of Authentication by Passwords. It defines software-based requirements and procedures to strengthen user identification and password authentication in healthcare IT systems that rely on passwords as the sole authentication mechanism. The standard targets systems that handle sensitive, personally identifiable health information (for example electronic patient record systems, patient administration and laboratory systems) and excludes systems that use hardware tokens, smart cards or biometrics.
Key topics and technical requirements
EN 12251:2004 specifies practical controls for secure password management and authentication. Key technical topics include:
- Unique identification and authentication: use of unique user identifiers and passwords to verify claimed identities.
- Authentication before access: identification/authentication must precede any other interaction with the system.
- User attribute association: ability to link site-defined attributes (name, affiliation) to each user identifier.
- Log‑on messaging: site‑specifiable warning message about unauthorized use displayed during log-on.
- Failure handling and lockout: site-specifiable limit on unsuccessful log-on trials (recommended: three) with alarms and temporary lockout actions.
- Silent error reporting: log-on error feedback must not reveal which part (identifier or password) was incorrect.
- Log‑on statistics: display last successful access time and number of failed attempts since then.
- Password sharing controls: no explicit facilitation of password sharing; systems may permit reuse but must not disclose association.
- Secure password storage: passwords stored in one‑way encrypted form; unencrypted passwords not retained.
- No password logging: actual or attempted passwords or invalid identifiers should not be logged by default.
- Password handling and lifecycle: suppression of password echo, user-changeable passwords with re-authentication, mandatory change of default passwords, initialised and temporary password mechanisms with enforced expiration.
- Expiration and notification: site-specifiable expiration by time or uses (recommended: two months or 100 uses) with advance notification.
- Guidance annexes: informative annexes cover complexity requirements, user responsibilities and secure password communication.
Applications
EN 12251:2004 is intended for implementation in healthcare software where passwords are the only authentication method. Typical applications:
- Electronic health records (EHR/EMR) systems
- Patient administration systems (PAS)
- Laboratory Information Management Systems (LIMS)
- Clinical order-entry and results-reporting systems
Adopting EN 12251 improves password security, reduces risk of unauthorized access to patient data and supports compliance and risk management in healthcare IT deployments.
Who should use this standard
- Healthcare IT vendors and software developers
- Hospital and clinic IT/security administrators
- System integrators and implementers of EHR/LIMS/PAS
- Procurement, compliance and privacy officers evaluating password-based authentication
Related standards
- Normative reference: ISO 7498-2 (security architecture).
- EN 12251 is a CEN/TC 251 health informatics standard and supersedes ENV 12251:2000.
Keywords: EN 12251:2004, health informatics, secure user identification, password management, authentication, healthcare IT systems, electronic patient record, password security.
Standards Content (Sample)
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Zdravstvena informatika – Varna identifikacija uporabnikov v zdravstvenem varstvu – Upravljanje in varnost avtentikacije z gesliMedizinische Informatik - Sichere Nutzeridentifikation im Gesundheitswesen - Management und Sicherheit für die Authentifizierung durch PasswörterInformatique de santé - Sécurité de l'identification de l'utilisateur des soins de santé - Gestion et sécurité de l'authentification des mots de passeHealth informatics - Secure User Identification for Health Care - Management and Security of Authentication by Passwords35.240.80Uporabniške rešitve IT v zdravstveni tehnikiIT applications in health care technologyICS:Ta slovenski standard je istoveten z:EN 12251:2004SIST EN 12251:2005en01-januar-2005SIST EN 12251:2005SLOVENSKI
STANDARDSIST ENV 12251:20031DGRPHãþD
EUROPEAN STANDARDNORME EUROPÉENNEEUROPÄISCHE NORMEN 12251August 2004ICS 35.240.80 English versionHealth informatics - Secure User Identification for Health Care -Management and Security of Authentication by PasswordsInformatique de santé - Sécurité de l'identification del'utilisateur des soins de santé - Gestion et sécurité del'authentification des mots de passeMedizinische Informatik - Sichere Nutzeridentifikation imGesundheitswesen - Management und Sicherheit für dieAuthentifizierung durch PasswörterThis European Standard was approved by CEN on 21 June 2004.CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this EuropeanStandard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such nationalstandards may be obtained on application to the Central Secretariat or to any CEN member.This European Standard exists in three official versions (English, French, German). A version in any other language made by translationunder the responsibility of a CEN member into its own language and notified to the Central Secretariat has the same status as the officialversions.CEN members are the national standards bodies of Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Finland, France,Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia,Slovenia, Spain, Sweden, Switzerland and United Kingdom.EUROPEAN COMMITTEE FOR STANDARDIZATIONCOMITÉ EUROPÉEN DE NORMALISATIONEUROPÄISCHES KOMITEE FÜR NORMUNGManagement Centre: rue de Stassart, 36
B-1050 Brussels© 2004 CENAll rights of exploitation in any form and by any means reservedworldwide for CEN national Members.Ref. No. EN 12251:2004: ESIST EN 12251:2005
Potential password complexity requirements.10 Annex B (informative)
User responsibilities.11 Annex C (informative)
Password communication.12 Bibliography.13
1 Scope This document is designed to improve the authentication of individual users of health care IT systems, by strengthening the automatic software procedures associated with the management of user identifiers and passwords, without resorting to additional hardware facilities. This document applies to all information systems (hereafter called systems) within the health care environment that handle or store sensitive person identifiable health information, using passwords as the only means of authenticating the entered user identifier, i.e., verifying the claimed identity of a user. Systems that fall within the scope of this document include for example electronic patient record systems, patient administrative systems and laboratory systems, containing personal health information. This document does not apply to systems outside the health care environment. Neither does it apply to systems within the health care environment that use other means of identification and authentication, such as smart cards, biometric methods or other technical facilities. 2 Normative references
The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 7498-2, Information processing systems – Open systems interconnection – Basic reference model – Part 2: Security architecture 3 Terms and definitions For the purposes of this document, the following terms and definitions apply. 3.1
access control prevention of unauthorised use of a resource, including the prevention of use of a resource in an unauthorised manner 3.2 authentication process of verifying a claimed user identity, in this document on the basis of an entered user identifier and password 3.3 authentication information information used to establish the validity of a claimed identity [ISO 7498-2] 3.4
authorised user person who is given access rights to the system, i.e., person who is given a unique user identifier and an initial password, and by this is given
...
Frequently Asked Questions
SIST EN 12251:2005 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Health informatics - Secure User Identification for Health Care - Management and Security of Authentication by Passwords". This standard covers: This document is designed to improve the authentication of individual users of health care IT systems, by strengthening the automatic software procedures associated with the management of user identifiers and passwords, without resorting to additional hardware facilities. This document applies to all information systems (hereafter called systems) within the health care environment that handle or store sensitive person identifiable health information, using passwords as the only means of authenticating the entered user identifier, i.e., verifying the claimed identity of a user. Systems that fall within the scope of this document include for example electronic patient record systems, patient administrative systems and laboratory systems, containing personal health information. This document does not apply to systems outside the health care environment. Neither does it apply to systems within the health care environment that use other means of identification and authentication, such as smart cards, biometric methods or other technical facilities.
This document is designed to improve the authentication of individual users of health care IT systems, by strengthening the automatic software procedures associated with the management of user identifiers and passwords, without resorting to additional hardware facilities. This document applies to all information systems (hereafter called systems) within the health care environment that handle or store sensitive person identifiable health information, using passwords as the only means of authenticating the entered user identifier, i.e., verifying the claimed identity of a user. Systems that fall within the scope of this document include for example electronic patient record systems, patient administrative systems and laboratory systems, containing personal health information. This document does not apply to systems outside the health care environment. Neither does it apply to systems within the health care environment that use other means of identification and authentication, such as smart cards, biometric methods or other technical facilities.
SIST EN 12251:2005 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security; 35.240.80 - IT applications in health care technology. The ICS classification helps identify the subject area and facilitates finding related standards.
SIST EN 12251:2005 has the following relationships with other standards: It is inter standard links to SIST ENV 12251:2003. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
You can purchase SIST EN 12251:2005 directly from iTeh Standards. The document is available in PDF format and is delivered instantly after payment. Add the standard to your cart and complete the secure checkout process. iTeh Standards is an authorized distributor of SIST standards.
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.
Loading comments...