ATNA Profile FAQ

The Audit Trail and Node Authentication (ATNA) Integration Profile establishes security measures which, together with the Security Policy and Procedures, provide patient information confidentiality, data integrity and user accountability. This environment is considered the Security Domain and can scale from a department, to enterprise or affinity domain

This FAQ answers questions about what this Profile does and how it is used. For FAQs about Implementing the Profile, see the link in the See Also section below.

Why does ATNA only use TLS?

ATNA "Node Authentication" requirements are setting a minimum-interoperability specification. TLS is a mature, well understood, and widely implemented standard that meets the requirements of mutual authentication with optional confidentiality protections.

Why doesn't ATNA use Web-Services Security?

As is stated, the requirements in ATNA are a floor. At this time the best interoperability that provides protections for Confidentiality, Integrity, and Authenticity is through TLS. The Web-Services Security standard have been implemented, but at this time there is poor interoperability. This is the experience of the general industry using Web-Services as well as for healthcare.

The ATNA profile does not restrict an implementation from using Web-Services Security, but does simply require that at a minimum TLS be available.

See Also

The [ITI Technical Framework] is the official master document for this Profile.

For assistance with implementing ATNA see the ATNA FAQ.

DICOM supplement 95 contains MOST of the Audit Trail stuff

RFC 3881 is contains the base data model.

This page is based on the Profile FAQ Template