Difference between revisions of "Audit Trail and Node Authentication"

Latest revision as of 11:46, 19 November 2021

Basic security through (a) functional access controls, (b) defined security audit logging and (c) secure network communications

Formal Specification

ATNA (html) specification

Final Text

Additional Supplements:

Add RESTful Query and Feed to ATNA - Trial Implementation

@@ Line 1: / Line 1: @@
-Audit Trail and Node Authentication [ATNA] describes certificate-based node authentication and transmitting PHI-related audit events to a repository. This helps sites implement confidentiality policies.
+Basic security through (a) functional access controls, (b) defined security audit logging and (c) secure network communications
 __TOC__
+==Formal Specification==
-==Summary==
+===[https://profiles.ihe.net/ITI/TF/Volume1/ch-9.html ATNA (html) specification]===
+* [https://profiles.ihe.net/ITI/TF/Volume1/ch-9.html Final Text]
-The Audit Trail and Node Authentication (ATNA) Integration Profile establishes security measures which, together with the Security Policy and Procedures of the enterprise, provide patient information confidentiality, data integrity and user accountability.
+===Additional Supplements:===
+* [[Add RESTful Query and Feed to ATNA]] - Trial Implementation
-ATNA requires the use of bi-directional certificate-based node authentication for connections to and from each node, and requires that events concerning PHI use are recorded and transmitted to a repository where they can be monitored to detect indications of inappropriate activity.
+==See Also==
-''<Insert a simple graphic that, at a glance, visually summarizes what the profile is about.  Do not use an actor/transaction diagram here.  Show your graphic to someone for 5 seconds (literally) and ask them what it's about.  If what they say hits the main points in your summary paragraph, you have succeeded.  E.g. a graphic of a hospital, a clinic, and a lab with patient records moving between them.  .>''
-''<See [[Help:Contents#Tips_.26_Tricks| Help - Tips and Tricks]] for details on inserting an image/graphic.>''
-==Benefits==
-''<List the key benefits the profile provides (e.g. error reduction, increased throughput) and how they come about (e.g. SWF reduces patient errors due to mistyped demographics at the modality by transfering demographics electronically from the Order Filler).  Consider using a bullet list for readability>''
-==Details==
-ATNA ''uses XYZ to carry audit messages formated as XML from the originating system to the audit repository etc etc.''
-''Something about what Node authentication means and a couple details about what kind of certificates??''
-Other Domains extend the ATNA Profile by defining specific audit events and details relevant to their specific domain.
-''(From an email by Rob Horn)''
-We have done this only for profiles that were most critical (e.g. XDS, RFD, EUA, XUA). There is some interested in RID and PIX, we need help to create prioritized CP requests for clarity on profiles that the IHE community needs assistance with.
-There is also some historical funny business.  Originally HL7 was going to
-issue an HL7 side equivalent to DICOM's Supplement 95, but that lost
-sponsorship and got abandoned.  So DICOM threw together some partial stuff
-to cover the immediate needs of the imaging community.  It deals with only
-those HL7ish things that happen to DICOM equipment (like receiving
-orders).  DICOM didn't attempt to handle the rest of the HL7 world.  So
-the various IHE domains get creative in a variety of ways.
-==Systems Affected==
-''<List (in user terms) systems that would be likely candidates for implementing this profile, e.g. RIS, PACS, HIS, CAD Workstation, etc. >''
-'''Actors & Transactions:'''
-''<Insert an actor-transaction diagram, and or list of Content Definitions>''
-==Specification==
-'''Profile Status:''' [[Comments| Final Text]]
-''<Replace "Final Text" with "Trial Implementation" or "Public Comment" as appropriate.>''
-'''Documents:'''
-''<Provide direct links to the specific volumes or supplements, and list the volume sections relevant to this profile.  This is a simple inventory of official normative and informative text.  If you would like to provide a reading guide or walkthrough of what is in each of the different sections for implementers or users, do that in the Profile FAQ or the Profile Implementation Page linked below.  If the profile uses transactions from multiple Tech. Frameworks, repeat the structure below.>''
-[http://www.ihe.net/Technical_Framework/index.cfm#IT IHE IT Infrastructure Technical Framework:]
+This profile supports the security/privacy model discussed in [[IHE Security and Privacy for HIE]] white paper.
-:* [http://www.ihe.net/Technical_Framework/upload/???.pdf Vol. 1] - Section 9 (ATNA Profile)
-:* [http://www.ihe.net/Technical_Framework/upload/???.pdf Vol. 2] - Sections 3.16 and 3.17
-[http://www.ihe.net/Technical_Framework/index.cfm#radiology IHE Radiology Technical Framework:]
+See [[ATNA FAQ]] for implementation assistance, and [[ATNA Profile FAQ]] for other random help.
-:* ''repeat listing of Rad sections here or just point to Rad Option?''
-:* [ftp://medical.nema.org/medical/dicom/supps/sup95_fz.pdf DICOM Supplement 95 - Frozen]
-'''Underlying Standards:'''
+For information related to testing the ATNA profile at IHE Connectathons, [https://gazelle.ihe.net/content/atna-testing-connectathon-digital-certificates read this][
-''<list all the standards on which the profile is based; if possible with links to sources>''
-:* [http://www.hl7.org HL7?]
-:* Syslog?
-:* XML?
-:* ... The underlying RFC can be found at a variety of RFC repositories
-==See Also==
-''<The following sections can be left out if there is nothing to point to.  This is just to show where such information can go.>''
+NEMA White Paper on [http://www.medicalimaging.org/wp-content/uploads/2011/02/CertificateManagement-2007-05-Published.pdf Management of Machine Authentication Certificates]
 '''Related Profiles'''
-''<List profiles this one depends on, profiles that depend on this one, profiles that are synergistic with this one.  Start with the name of the other profile as a link and then explain the relationship.>''
+* [[Add RESTful Query and Feed to ATNA]] option on ATNA to enable a FHIR AuditEvent feed and query
+* [[Audit Trail and Node Authentication - Radiology Option]] extends ATNA with Radiology-specific audit trail messages.
-* [[Audit Trail and Node Authentication - Radiology Option]] defines Radiology-specific audit trail messages and security measures to ATNA.
+* [[Consistent_Time | Consistent Time]]
-* [[Cross-enterprise Document Sharing]] [XDS] depends on ATNA for ...
-* ...
-'''Consumer Information'''
-The [[ATNA Profile FAQ Template]] answers typical questions about what the Profile does.
-The [[Profile Purchasing Template]] describes considerations when purchasing equipment to deploy this Profile.
-'''Implementer Information'''
-[[Audit Trail and Node Authentication Implementation]] provides additional information about implementing this Profile in software.  Specific questions about how to implement this profile can be found in the [[ATNA FAQ]].
-White Paper [[IHE Security and Privacy for HIE]] puts ATNA in context.
-'''Reference Articles'''
-Creating an IHE ATNA-Based Audit Repository, Gregg, B. et al, Journal of Digital Imaging, Vol. 19, Number 4, 2006, pp. 307-315
 This page is based on the [[Profile Template]]
 [[Category:Profiles]]
 [[Category:ITI Profile]]
+[[Category:FHIR]]
+[[Category:Security]]
+Current: [[Frameworks#IHE IT Infrastructure Technical Framework| IT Infrastructure Technical Framework]].

Difference between revisions of "Audit Trail and Node Authentication"

Latest revision as of 11:46, 19 November 2021

Contents

Formal Specification

ATNA (html) specification

Additional Supplements:

See Also

Navigation menu

Search