Difference between revisions of "Audit Trail and Node Authentication"

From IHE Wiki
Jump to navigation Jump to search
m
Line 22: Line 22:
 
User Accountability is provided through Audit Trail. The Audit Trail needs to allow a security officer in an institution to audit activities, to assess compliance with a secure domain’s policies, to detect instances of non-compliant behavior, and to facilitate detection of improper creation, access, modification and deletion of Protected Health Information (PHI).
 
User Accountability is provided through Audit Trail. The Audit Trail needs to allow a security officer in an institution to audit activities, to assess compliance with a secure domain’s policies, to detect instances of non-compliant behavior, and to facilitate detection of improper creation, access, modification and deletion of Protected Health Information (PHI).
  
 +
===Objective & scope===
 +
The aim is to extend the IHE initiative to [http://riftgold.wordpress.com/2011/02/21/is-rift-better-than-wow/ wow gold] anatomic pathology laboratories, their [http://dcuocash.wordpress.com/2011/02/22/dcuo-reviews/ dcuo cash] information, automation, imaging systems and equipments.
 +
 +
 +
The scope of the [http://riftgold.wordpress.com/2011/02/22/rift-class-guide/ rift plat] anatomic pathology includes [http://www.gamerking.com/rift-character-creation-guide/ rift plat] surgical pathology, [http://www.warcraftgold.com/rift-toon-creation-guide/ rift plat] biopsies pathology, [http://www.ffxifactory.com/rift-character-creation-walkthrough/ rift plat] cytopathology, [http://www.platsupply.com/rift-toon-creation-walkthrough/ rift plat] autopsies, and other [http://atanium.blogspot.com/2011/02/rift-guide-how-to-create-new-character.html rift plat] related techniques (immunohistochemistry, molecular pathology, etc).
 +
 +
 +
Information systems in anatomic [http://riftgold.wordpress.com/2011/02/23/rift-guide-how-to-build-a-fresh-toon/ rift plat] pathology laboratories gather medical data (text, images, etc) throughout the [http://riftgold.wordpress.com/2011/02/24/rifts-official-server-list/ rift plat] specimen management from specimen reception to report editing.
 +
 +
 +
The diagnostic process in [http://yourgameupdates.blogspot.com/2011/02/dcuo-first-patch-goes-live.html dcuo cash] anatomical pathology (figure 1) differs from that in the clinical laboratory since it relies on image interpretation and [http://yourgameupdates.blogspot.com/2011/01/left-4-dead-2-cheats.html left 4 dead 2 cheats]. It also differs from that in radiology since it is specimen-driven and when digital imaging is performed many types of imaging equipments (gross imaging, microscopic still imaging, whole slide imaging, multispectral imaging, etc) may be involved for a single examination. Moreover, with [http://manuelcadaing.com/godaddy-promo-code-and-coupon-list/ GoDaddy Promo Code] you'll be advance in game and images of the same study may be related to different specimen (parts and/or slides) from one or even different patients (e.g Tissue Micro Array). Finally with [http://manuelcadaing.com/seo-elite-review/ SEO Elite Review], slides are always available to acquire more images, if needed. In radiology, the diagnostic process is patient-driven, an examination (study) usually involves a single image acquisition modality and all images of the study are related to one and only one patient.
  
 
==Systems Affected==
 
==Systems Affected==

Revision as of 02:52, 24 February 2011


Summary

The Audit Trail and Node Authentication (ATNA) Integration Profile establishes security measures which, together with the Security Policy and Procedures, provide patient information confidentiality, data integrity and user accountability.

Benefits

Assistance to sites in implementing security and confidentiality policies

  • This model is partially driven by the underlying assumption that there will be situations where documents are being exchanged between machines and stored on the recipient. This is partly driven by the need for healthcare systems to operate in disasters and overload situations, where the network operation is limited or destroyed. It is not safe to assume that clients are display only. So there will be semi-permanent copies of most information kept. Even in normal operation, healthcare providers may have only 15 minutes per patient. Good healthcare system design recognizes the need to not waste any of those seconds searching and transferring documents over a network. The documents are transferred in advance, and are kept locally until it is determined that they are no longer needed. There are thin client display only applications in healthcare, but they are limited to uses that can fail without introducing risks to safety or patient health, but a complete security/privacy design requires handling situations where data is stored after retrieval.

Details

The Audit Trail and Node Authentication (ATNA) Integration Profile: contributes to access control by limiting network access between nodes and limiting access to each node to authorized users. Network communications between secure nodes in a secure domain are restricted to only other secure nodes in that domain. Secure nodes limit access to authorized users as specified by the local authentication and access control policy.

  • User Authentication

The Audit Trail and Node Authentication Integration Profile requires only local user authentication. The profile allows each secure node to use the access control technology of its choice to authenticate users. The use of Enterprise User Authentication is one such choice, but it is not necessary to use this profile.

  • Connection Authentication

The Audit Trail and Node Authentication Integration Profile requires the use of bi-directional certificate-based node authentication for connections to and from each node. The DICOM, HL7, and HTML protocols all have certificate-based authentication mechanisms defined. These authenticate the nodes, rather than the user. Connections to these machines that are not bi-directionally node-authenticated shall either be prohibited, or be designed and verified to prevent access to PHI.

  • Audit Trails

User Accountability is provided through Audit Trail. The Audit Trail needs to allow a security officer in an institution to audit activities, to assess compliance with a secure domain’s policies, to detect instances of non-compliant behavior, and to facilitate detection of improper creation, access, modification and deletion of Protected Health Information (PHI).

Objective & scope

The aim is to extend the IHE initiative to wow gold anatomic pathology laboratories, their dcuo cash information, automation, imaging systems and equipments.


The scope of the rift plat anatomic pathology includes rift plat surgical pathology, rift plat biopsies pathology, rift plat cytopathology, rift plat autopsies, and other rift plat related techniques (immunohistochemistry, molecular pathology, etc).


Information systems in anatomic rift plat pathology laboratories gather medical data (text, images, etc) throughout the rift plat specimen management from specimen reception to report editing.


The diagnostic process in dcuo cash anatomical pathology (figure 1) differs from that in the clinical laboratory since it relies on image interpretation and left 4 dead 2 cheats. It also differs from that in radiology since it is specimen-driven and when digital imaging is performed many types of imaging equipments (gross imaging, microscopic still imaging, whole slide imaging, multispectral imaging, etc) may be involved for a single examination. Moreover, with GoDaddy Promo Code you'll be advance in game and images of the same study may be related to different specimen (parts and/or slides) from one or even different patients (e.g Tissue Micro Array). Finally with SEO Elite Review, slides are always available to acquire more images, if needed. In radiology, the diagnostic process is patient-driven, an examination (study) usually involves a single image acquisition modality and all images of the study are related to one and only one patient.

Systems Affected

Systems involved in this profile are:

  • Any local or enterprise-wide healthcare information systems that manage or process Protected Health Information


Actors & Transactions:

ATNA-Actor-Transaction.jpg

Specification

Profile Status: Final Text

Documents: IHE IT Infrastructure Technical Framework Version 2 or later

  • Vol. 1 - Section 9
  • Vol. 2 - Sections 3.19, 3.20

Underlying Standards:

See Also

This profile supports the security/privacy model discussed in IHE Security and Privacy for HIE white paper.

See ATNA FAQ for implementation assistance, and ATNA Profile FAQ for other random help.

The 2008 connectathon tests for XDS related actors can be found at http://ihewiki.wustl.edu/wiki/index.php/XDS_Syslog_testing_requirements#Audit_log_requirements_for_XDS_at_2008_Connectathon

NIST SP800-92 Guide to Computer Security Log Management

NEMA White Paper on Management of Machine Authentication Certificates

Related Profiles

This page is based on the Profile Template

Current: IT Infrastructure Technical Framework.

Retrieved from "http://wiki.ihe.net/index.php?title=Audit_Trail_and_Node_Authentication&oldid=48451"