1. 1 Integrating the Healthcare Enterprise Audit Trail and Node Authentication Profile IHE IT Technical and Planning Committee June 15 th – July 15 th 2004 - Public Comment

2. IT Infrastructure – Audit Trail & Node Authentication 2 IHE drives healthcare standards based-integration

3. IT Infrastructure – Audit Trail & Node Authentication 3 IHE 2004 achievements and expanding scope Over 80 vendors involved world-wide, 4 Technical Frameworks 31 Integration Profiles, Testing at yearly Connectathons, Demonstrations at major exhibitions world-wide Provider-Vendor cooperation to accelerate standards adoption

4. IT Infrastructure – Audit Trail & Node Authentication 4 IHE Process Users and vendors work together to identify and design solutions for integration problems Intensive process with annual cycles: – Identify key healthcare workflows and integration problems – Research & select standards to specify a solution – Write, review and publish IHE Technical Framework – Perform cross-testing at “Connectathon” – Demonstrations at tradeshows (HIMSS/RSNA…)

5. IT Infrastructure – Audit Trail & Node Authentication 5 A Proven Standards Adoption Process IHE Integration Profiles B IHE Integration Profile A Easy to Integrate Products IHE Connectathon Product With IHE IHE Demonstration User Site RFP Standards IHE Technical Framework Product IHE Integration Statement IHE Connectathon Results IHE Integration Profiles at the heart of IHE : – Detailed selection of standards and options each solving a specific integration problem – A growing set of effective provider/vendor agreed solutions – Vendors can implement with ROI – Providers can deploy with stability

6. IT Infrastructure – Audit Trail & Node Authentication 6 More on IHE IT Infrastructure To learn more about IHE IT Infrastructure Integrating the Healthcare Enterprise: www.himss.org/ihe Read the IHE Brochure http://www.himss.org/content/files/IHE_newsletter_final.pdf

7. IT Infrastructure – Audit Trail & Node Authentication 7 Audit Trail and Node Authentication (ATNA) – Abstract/Scope HIPAA means more attention and care to protect Patient’s Privacy, and this requires Security. In Healthcare we have Protected Health Information for patients such as orders, procedure, images, films and reports. The confidentiality, integrity, and availability of this information must be assured. – authorized persons must have access to medical data of patients, and the information must not be disclosed otherwise.

8. IT Infrastructure – Audit Trail & Node Authentication 8 Audit Trail and Node Authentication (ATNA) – Value Proposition  Assures Authorized users gain access to secure nodes  Verifies that only secure nodes exchange data.  Provides audit facility to  Verify compliance with procedures  Permit detection of inappropriate behavior  Without interfering with time critical activities

9. IT Infrastructure – Audit Trail & Node Authentication 9 ATNA -- Environment Required Physical Security Doors, key access, etc. restrict access Communications and Equipment are kept in restricted access areas Access to equipment is controlled Cabinets, wiring, etc. are protected.

10. IT Infrastructure – Audit Trail & Node Authentication 10 ATNA -- Environment Required Network Security Firewalls, VPN, and other access controls. Unauthorized external access is denied. Additional security facilities may be in place if warranted by local conditions.

11. IT Infrastructure – Audit Trail & Node Authentication 11 ATNA -- Node Authentication Configuration System A System B Secure network Secured Node Manually managed Node Authentication Certificates

12. IT Infrastructure – Audit Trail & Node Authentication 12 ATNA: Typical Workflow System A System B Secured System Secure network Strong authentication of remote node (digital certificates) network traffic encryption is not required Secured System Local access control (authentication of user) Audit trail with: Real-time access Time synchronization Central Audit Trail Repository

13. IT Infrastructure – Audit Trail & Node Authentication 13 ATNA – Example “Transfer Image” Audit Message - - - - - - String - - String

14. IT Infrastructure – Audit Trail & Node Authentication 14 ATNA – Technical Details Locally defined User Identification, Authentication, and Authorization Node to Node communications authenticated – HL7 – TLS – Digital Certificates – DICOM – TLS – Digital Certificates – HTTP – TLS – Digital Certificates Audit Trails – Reliable SYSLOG (Cooked) – IETF Audit Message Schema – DICOM Audit Message details – IHE further clarifications for events not detailed in DICOM

15. IT Infrastructure – Audit Trail & Node Authentication 15 More information…. Web sites: www.himss.org/ihewww.himss.org/ihe www.rsna.org/ihe www.ihe-europe.org – IHE IT Infrastructure Technical Framework for 2003- 2004 - V 1.0 Final Text – IHE IT Infrastructure Technical Framework Supplements for 2004-2005 – Public Comments – Comments at http://forums.rsna.org, IHE forum, IT Infrastructure sub-forum, until July 15 th, 2004. Non-Technical Brochures : Non-Technical Brochures : – IHE Brochure, IHE Fact Sheet – IHE Connectathon Results – IHE Products Integration Statements