Integrating the Healthcare Enterprise Audit Trail and Node Authentication Profile Name of Presenter IHE affiliation

HIMSS Annual Conference 2004 IHE drives healthcare standards based-integration

HIMSS Annual Conference 2004 IHE 2004 achievements and expanding scope Over 80 vendors involved world-wide, 4 Technical Frameworks 31 Integration Profiles, Testing at yearly Connectathons, Demonstrations at major exhibitions world-wide Provider-Vendor cooperation to accelerate standards adoption

HIMSS Annual Conference 2004 IHE Process Users and vendors work together to identify and design solutions for integration problems Intensive process with annual cycles: – Identify key healthcare workflows and integration problems – Research & select standards to specify a solution – Write, review and publish IHE Technical Framework – Perform cross-testing at “Connectathon” – Demonstrations at tradeshows (HIMSS/RSNA…)

HIMSS Annual Conference 2004 A Proven Standards Adoption Process IHE Integration Profiles B IHE Integration Profile A Easy to Integrate Products IHE Connectathon Product With IHE IHE Demonstration User Site RFP Standards IHE Technical Framework Product IHE Integration Statement IHE Connectathon Results IHE Integration Profiles at the heart of IHE : – Detailed selection of standards and options each solving a specific integration problem – A growing set of effective provider/vendor agreed solutions – Vendors can implement with ROI – Providers can deploy with stability

HIMSS Annual Conference 2004 More on IHE IT Infrastructure To learn more about IHE IT Infrastructure Integrating the Healthcare Enterprise: Read the IHE Brochure

HIMSS Annual Conference 2004 Audit Trail and Node Authentication (ATNA) – Abstract/Scope HIPAA means more attention and care to protect Patient’s Privacy, and this requires Security. In Healthcare we have Protected Health Information for patients such as orders, procedure, images, films and reports. The confidentiality, integrity, and availability of this information must be assured. – authorized persons must have access to medical data of patients, and the information must not be disclosed otherwise.

HIMSS Annual Conference 2004 Audit Trail and Node Authentication (ATNA) – Value Proposition  Assures Authorized users gain access to secure nodes  Verifies that only secure nodes exchange data.  Provides audit facility to  Verify compliance with procedures  Permit detection of inappropriate behavior  Without interfering with time critical activities

HIMSS Annual Conference 2004 ATNA -- Environment Required Physical Security Doors, key access, etc. restrict access Communications and Equipment are kept in restricted access areas Access to equipment is controlled Cabinets, wiring, etc. are protected.

HIMSS Annual Conference 2004 ATNA -- Environment Required Network Security Firewalls, VPN, and other access controls. Unauthorized external access is denied. Additional security facilities may be in place if warranted by local conditions.

HIMSS Annual Conference 2004 ATNA -- Node Authentication Configuration System A System B Secure network Secured Node Manually managed Node Authentication Certificates

HIMSS Annual Conference 2004 ATNA: Typical Workflow System A System B Secured System Secure network Strong authentication of remote node (digital certificates) network traffic encryption is not required Secured System Local access control (authentication of user) Audit trail with: Real-time access Time synchronization Central Audit Trail Repository

HIMSS Annual Conference 2004 ATNA – Example “Transfer Image” Audit Message String - - String

HIMSS Annual Conference 2004 ATNA – Technical Details Locally defined User Identification, Authentication, and Authorization Node to Node communications authenticated – HL7 – TLS – Digital Certificates – DICOM – TLS – Digital Certificates – HTTP – TLS – Digital Certificates Audit Trails – Reliable SYSLOG (Cooked) – IETF Audit Message Schema – DICOM Audit Message details – IHE further clarifications for events not detailed in DICOM

HIMSS Annual Conference 2004 More information…. Web sites: – IHE Rad Technical framework for year 5 – V5.5 – IHE IT Technical framework for year 1 – V 1.0 Non-Technical Brochures : – IHE Fact Sheet and IHE FAQ – IHE Integration Profiles: Guidelines for Buyers – IHE Connectathon Results