Audit Trail and Node Authentication - Radiology Option
The ATNA Radiology profile specifies basic security measures that can help protect the confidentiality of patient information as part of an institution's overall security policies and procedures. ATNA provides institutions with a mechanism to consolidate audit trail events on user activity across several imaging and information systems throughout the enterprise systems interconnected in a secure manner. The Radiology option defines further requirements for the ATNA profile, which are specific for this domain.
Summary
The Radiology Audit Trail Option defines the specific requirements of the IHE Radiology transactions for supporting the IHE ITI Audit Trail and Node Authentication profile. This option deals largely with the details of the Record Audit Event transaction in the IHE ITI Technical Framework. The option details the required audit events for each of the IHE Radiology transactions,based on the different trigger events.
Benefits
Securing the exchange of patient healthcare information, and logging key events during the processing of healthcare data increases the reliability of the underlying information systems and provides accountability for users of these systems. This is achieved by combining the ATNA requirements with the relevant IHE profiles, using industry standards like TLS and Syslog.
Some of the benefits are:
- Authentication/Access control: network access are limited between nodes (access restriction to secure nodes only) and between each nodes to authorized users (depending on local authentication and access control policy)
- Audit trail: allows detection of non-compliant behaviour instances, or improper creation, access, modification and deletion of Protected Health Information (PHI)
- Centralized audit record repository, making easier the implementation of security requirements
Details
Node authentication gives a means to control network access by :
- Using, from and to each node, a mandatory bi-directional certificate-based node authentication,
- Allowing, for each node, the use of the user’s authentication and access control policy of its choice.
Audit Trails are based on the production of audit records, that provide a record of actions such as queries, views, additions, deletions and changes that are processed within the Security Domain covered by ATNA. Records are triggered by trigger events described in this profile.
Some of the trigger events described in ATNA are not relevant in the ATNA Radiology option. These trigger events are:
- Health-service-event
- Medication
- Patient-care-assignment
- Patient-care-episode
- Patient-care-protocol
More details concering the ATNA profile can be seen on the: Audit Trail and Node Authentication
Systems Affected
All systems which participate in Radiology Framework transactions with corresponding audit events are affected. See Table 5.12 IHE Radiology transactions and resulting ATNA trigger events in volume 3 of the IHE Radiology technical framework.
Actors & Transactions:
ATNA is security domain that involves all kind of Information Systems that could be used within a department up to a XDS-I Affinity Domain.
Specification
Profile Status: Final Text
Documents:
ITI Technical Framework, Volume 1 - Section 9 documents the ATNA profile
ITI Technical Framework, Volume 2 - Section 3.20 documents Record Audit Event transaction and with special attention on the trigger events, on which the radiology option is largely based.
Radiology Technical Framework, Volume 1 - Appendix H (informative) gives consideration on the security environment within the XDS-I profile
Radiology Technical Framework] - Section 5 documents the Audit trail radiology option.
Underlying Standards:
- http://www.ietf.org/rfc/rfc4346.txt - TLS
- http://www.ietf.org/rfc/rfc3881.txt - Security Audit and Access Accountability Message XML Data Definitions for Healthcare Applications
- ftp://medical.nema.org/medical/dicom/supps/sup95_fz.pdf - DICOM Supplement 95: Audit Trail Messages
See Also
Related Profiles
- Audit Trail and Node Authentication (ATNA) is the profile this option augments.
Consumer Information
- The ATNA Profile FAQ answers typical questions about what the Profile does.
Audit Trail and Node Authentication Purchasing describes considerations when purchasing equipment to deploy this Profile.
Implementer Information
- Audit Trail and Node Authentication Implementation provides additional information about implementing this Profile in software.
Reference Articles
- Creating an IHE ATNA-Based Audit Repository, Gregg, B. et al, Journal of Digital Imaging, Vol. 19, Number 4, 2006, pp. 307-315 - http://www.springerlink.com/content/a587222402764162/