1、BSI Standards Publication PD CEN ISO/TS 14441:2013 Health informatics Security and privacy requirements of EHR systems for use in conformity assessment Incorporating corrigendum February 2014PD CEN ISO/TS 14441:2013 National foreword This Published Document is the UK implementation of CEN ISO/TS 144
2、41:2013. The UK participation in its preparation was entrusted to Technical Committee IST/35, Health informatics. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract
3、. Users are responsible for its correct application. The British Standards Institution 2014. Published by BSI Standards Limited 2014 ISBN 978 0 580 85785 0 ICS 35.240.80 Compliance with a British Standard cannot confer immunity from legal obligations. This Published Document was published under the
4、authority of the Standards Policy and Strategy Committee on 31 December 2013. Amendments/corrigenda issued since publication Date Text affected 28 February 2014 Implementation of CEN correction notice 18 December 2013: CEN Endorsement Notice inserted PUBLISHED DOCUMENT TECHNICAL SPECIFICATION SPCIFI
5、CATION TECHNIQUE TECHNISCHE SPEZIFIKATION CEN ISO/TS 14441 December 2013 ICS 35.240.80 English Version Health informatics - Security and privacy requirements of EHR systems for use in conformity assessment (ISO/TS 14441:2013)Informatique de sant - Scurit et exigences dintimit des systmes de EHR pour
6、 lvaluation de la conformit (ISO/TS 14441:2013) Medizinische Informatik - Sicherheits- und Datenschutzanforderungen fr die Konformittsprfung von EGA-Systemen (ISO/TS 14441:2013) This Technical Specification (CEN/TS) was approved by CEN on 7 April 2013 for provisional application. The period of valid
7、ity of this CEN/TS is limited initially to three years. After two years the members of CEN will be requested to submit their comments, particularly on the question whether the CEN/TS can be converted into a European Standard. CEN members are required to announce the existence of this CEN/TS in the s
8、ame way as for an EN and to make the CEN/TS available promptly at national level in an appropriate form. It is permissible to keep conflicting national standards in force (in parallel to the CEN/TS) until the final decision about the possible conversion of the CEN/TS into an EN is reached. CEN membe
9、rs are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portuga
10、l, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMIT EUROPEN DE NORMALISATION EUROPISCHES KOMITEE FR NORMUNG CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels 2013 CEN All rights of exploitation in any form
11、 and by any means reserved worldwide for CEN national Members. Ref. No. CEN ISO/TS 14441:2013 EPD CEN ISO/TS 14441:2013 CEN ISO/TS 14441:2013 (E) 3 Foreword This document (CEN ISO/TS 14441:2013) has been prepared by Technical Committee ISO/TC 215 “Health informatics” in collaboration with Technical
12、Committee CEN/TC 251 “Health informatics” the secretariat of which is held by NEN. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN and/or CENELEC shall not be held responsible for identifying any or all such patent rights. Acc
13、ording to the CEN-CENELEC Internal Regulations, the national standards organizations of the following countries are bound to announce this Technical Specification: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, G
14、ermany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom. Endorsement notice The text of ISO/TS 14441:2013 has been approved by CEN as CEN ISO/
15、TS 14441:2013 without any modification. PD CEN ISO/TS 14441:2013ISO/TS 14441:2013(E) ISO 2013 All rights reserved iii Contents Page Foreword iv Introduction v 1 Scope . 1 2 Normative references 1 3 T erms and definitions . 1 4 Abbreviations. 9 5 Security and privacy requirements 9 5.1 General . 9 5.
16、2 Theoretical foundation 9 5.3 Privacy and security requirements 12 5.4 Common Criteria 28 6 Best practice and guidance for establishing and maintaining conformity assessment programs .30 6.1 Concepts 31 6.2 Conformity assessment processes 33 Annex A (informative) Conformity assessment programs Desi
17、gn considerations and illustrative examples from member countries as of 2010 36 Annex B (informative) Comparison of jurisdictional requirements 54 Bibliography .112PD CEN ISO/TS 14441:2013ISO/TS 14441:2013(E) Foreword ISO (the International Organization for Standardization) is a worldwide federation
18、 of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee.
19、International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization. International Standards are drafted in accordance wit
20、h the rules given in the ISO/IEC Directives, Part 2. The main task of technical committees is to prepare International Standards. Draft International Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approv
21、al by at least 75 % of the member bodies casting a vote. In other circumstances, particularly when there is an urgent market requirement for such documents, a technical committee may decide to publish other types of document: an ISO Publicly Available Specification (ISO/PAS) represents an agreement
22、between technical experts in an ISO working group and is accepted for publication if it is approved by more than 50 % of the members of the parent committee casting a vote; an ISO Technical Specification (ISO/TS) represents an agreement between the members of a technical committee and is accepted fo
23、r publication if it is approved by 2/3 of the members of the committee casting a vote. An ISO/PAS or ISO/TS is reviewed after three years in order to decide whether it will be confirmed for a further three years, revised to become an International Standard, or withdrawn. If the ISO/PAS or ISO/TS is
24、confirmed, it is reviewed again after a further three years, at which time it must either be transformed into an International Standard or be withdrawn. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held respons
25、ible for identifying any or all such patent rights. ISO/TS 14441 was prepared by Technical Committee ISO/TC 215, Health informatics.iv ISO 2013 All rights reservedPD CEN ISO/TS 14441:2013ISO/TS 14441:2013(E) Introduction As local, regional and national EHR infostructures develop, electronic patient
26、record systems are being implemented at the many points of care where patients are seen point-of-service (POS) clinical systems. In addition to institutional settings like hospitals, where the systems in various departments (e.g. nursing units) are typically integrated into a single patient record,
27、smaller single purpose systems such as electronic medical records (EMRs) are also being implemented in physician offices and other non-institutional settings such as public health where the sophistication of the systems and the local IT support infrastructure is much less. As countries begin to conn
28、ect these POS clinical systems to EHR infostructures (or directly exchange clinical information with other POS clinical systems through system-to-system communications), the security and privacy of these systems becomes much more critical and complex than when the systems operated in a disconnected
29、or stand-alone state. To ensure the required standards are implemented correctly into these systems, so that they will securely interact with EHR infostructures and maintain the privacy of patient information, many countries are implementing certification and conformance testing programs to provide
30、objective evidence of conformity with these requirements. This Technical Specification identifies the security and privacy requirements, harvested from the above mentioned standards and international experiences, which should be in place for conformance testing for interoperable POS clinical (electr
31、onic patient record) systems interfacing with EHRs. The POS clinical systems profiled receive, store, process, display and communicate clinical data and administrative actions, as well as information related to system users (demographics, personal). The systems are always accessed by authorized and
32、authenticated users. These users are: health professionals that input, access and use patient data, clinical procedures, and statistics; administrative users that input and read patients personal and demographics data, administrative and statistical information; administrators that control users pow
33、er, perform backups, provide system configuration, including security ones; auditors that read audit trails; other EHR systems that input and receive data; subjects of care and their substitute decision makers, who may have restricted access to input and retrieve authorized data. Key assumptions tha
34、t apply for compliant POS clinical systems are as follows: the Target of Evaluation (TOE) comprises commercial off the shelf (COTS), governmental, proprietary and free and open source software; authenticated users recognize the need for a secure IT environment; authenticated users can be trusted to
35、comply with the organizations security policy; business security processes are implemented with due regard for what can (and cannot) be reasonably accomplished in a clinical setting; competent security administration is carried out in relation to the systems installation and ongoing operations. This
36、 Technical Specification draws from international standards, which have been developed by ISO/TC 215 for EHRs, as well as other ISO standards such as such as ISO/IEC 27001 and the ISO/IEC 17000 series of standards developed by the ISO Committee on conformity assessment (CASCO). This Technical Specif
37、ication also reflects the experience that various countries have had to date in implementing certification and conformance testing programs in addressing privacy and security requirements in the ISO 2013 All rights reserved vPD CEN ISO/TS 14441:2013ISO/TS 14441:2013(E) context where electronic patie
38、nt record (clinical) systems at the point of care are interoperable with regional and national EHRs. This Technical Specification includes: security and privacy requirements that should be met to ensure that information is protected as well as the main categories of attack; discussion of the theoret
39、ical foundations underpinning the requirements; guidance on best practice for establishing and maintaining conformity assessment programs; description of the conformity assessment process, including the key concepts and processes. Annex A provides more detailed information on conformity assessment m
40、odels and processes, plus examples of conformity assessment programs in four example countries at a point in time (2010). Annex B provides a detailed examination of the privacy and security requirements in place in five jurisdictions at the time that this Technical Specification was written. This an
41、alysis was used to derive the security and privacy requirements in Clause 5. This Technical Specification is to be used by agencies which accredit or operate programs for certifying health software products through conformity assessment against privacy and security standards, software suppliers demo
42、nstrating their compliance with those requirements, and purchasers of those systems who want assurance that the requirements have been met.vi ISO 2013 All rights reservedPD CEN ISO/TS 14441:2013TECHNICAL SPECIFICATION ISO/TS 14441:2013(E) Health informatics Security and privacy requirements of EHR s
43、ystems for use in conformity assessment 1 Scope This Technical Specification examines electronic patient record systems at the clinical point of care that are also interoperable with EHRs. Hardware and process controls are out of the scope. This Technical Specification addresses their security and p
44、rivacy protections by providing a set of security and privacy requirements, along with guidelines and best practice for conformity assessment. ISO/IEC 15408 (all parts) defines “targets of evaluation” for security evaluation of IT products. This Technical Specification includes a cross-mapping of 82
45、 security and privacy requirements against the Common Criteria categories in ISO/IEC 15408 (all parts). The point-of-service (POS) clinical software is typically part of a larger system, for example, running on top of an operating system, so it must work in concert with other components to provide p
46、roper security and privacy. While a Protection Profile (PP) includes requirements for component security functions to support system security services, it does not specify protocols or standards for conformity assessment, and does not address privacy requirements. This Technical Specification focuse
47、s on two main topics: a) Security and privacy requirements (Clause 5). Clause 5 is technical and provides a comprehensive set of 82 requirements necessary to protect (information, patients) against the main categories of risks, addressing the broad scope of security and privacy concerns for point of
48、 care, interoperable clinical (electronic patient record) systems. These requirements are suitable for conformity assessment purposes. b) Best practice and guidance for establishing and maintaining conformity assessment programs (Clause 6). Clause 6 provides an overview of conformity assessment conc
49、epts and processes that can be used by governments, local authorities, professional associations, software developers, health informatics societies, patients representatives and others, to improve conformity with health software security and privacy requirements. Annex A provides complementary information useful to countries in designing conformity assessment programs such as further material on conformity assessment business models, processes and other considerations, along with illustrative examples of conf
