ATNA Profile FAQ
The ATNA Profile
This FAQ answers questions about what this Profile does and how it is used. For FAQs about Implementing the Profile, see the link in the See Also section below.
Why does ATNA only use TLS?
ATNA "Node Authentication" requirements are setting a minimum-interoperability specification. TLS is a mature, well understood, and widely implemented standard that meets the requirements of mutual authentication with optional confidentiality protections.
Why doesn't ATNA use Web-Services Security?
As is stated, the requirements in ATNA are a floor. At this time the best interoperability that provides protections for Confidentiality, Integrity, and Authenticity is through TLS. The Web-Services Security standard have been implemented, but at this time there is poor interoperability. This is the experience of the general industry using Web-Services as well as for healthcare.
The ATNA profile does not restrict an implementation from using Web-Services Security, but does simply require that at a minimum TLS be available.
See Also
The [ITI Technical Framework] is the official master document for this Profile.
This page is based on the Profile FAQ Template