ATNA Profile FAQ
The Audit Trail and Node Authentication (ATNA) Integration Profile establishes security measures which, together with the Security Policy and Procedures, provide patient information confidentiality, data integrity and user accountability. This environment is considered the Security Domain and can scale from a department, to enterprise or affinity domain
This FAQ answers questions about what this Profile does and how it is used. For FAQs about Implementing the Profile, see the link in the See Also section below.
Why does ATNA only use TLS?
ATNA "Node Authentication" requirements are setting a minimum-interoperability specification. TLS is a mature, well understood, and widely implemented standard that meets the requirements of mutual authentication with optional confidentiality protections.
Why doesn't ATNA use Web-Services Security?
As is stated, the requirements in ATNA are a floor. At this time the best interoperability that provides protections for Confidentiality, Integrity, and Authenticity is through TLS. The Web-Services Security standard have been implemented, but at this time there is poor interoperability. This is the experience of the general industry using Web-Services as well as for healthcare.
The ATNA profile does not restrict an implementation from using Web-Services Security, but does simply require that at a minimum TLS be available.
Why does ATNA require AES?
AES is the replacement standard for 3DES. AES was selected by an extensive encryption standards discovery process in November 2001. It is designed to be harder to break than previous encryption algorithms yet also be appropriate for a wide variety of platforms including very low power embedded systems.
Why do we continue to accept 3DES for Connectathon and HIMSS 2007?
Because Microsoft platform (XP, 2000, 2003) has not yet provided the AES algorithm for their TLS implementation. AES is available in the Microsoft Crypto library, but not available in the TLS implementation. AES is available in the TLS implementation in Vista.
See Also
The [ITI Technical Framework] is the official master document for this Profile.
For assistance with implementing ATNA see the ATNA FAQ.
DICOM supplement 95 contains MOST of the Audit Trail stuff
[RFC 3881] contains the base data model.
This page is based on the Profile FAQ Template