ISO/TR 22696:2020
Health informatics — Guidance on the identification and authentication of connectable Personal Healthcare Devices (PHDs)
The document gives guidance for managing healthcare service security using connectable personal health devices. This document considers unidirectional data uploading from the PHD to the gateway (manager device), however, there are many clinical use cases for bidirectional data exchange.
This document is applicable to identification and authentication between the bidirectionally connected PHDs and gateway by providing possible use cases and the associated threats and vulnerabilities. Since some smart devices with mobile healthcare apps and software might connect to the healthcare service network, these devices will be considered connectable PHDs in this document. This document addresses those devices used in a homecare setting, where the knowledge and capabilities regarding the use of PHDs might not be as advanced as in other healthcare settings.
This document excludes specific protocols, methods and technical solutions for identification and authentication.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$179.13 NZD
|
|
| HardCopy |
$214.78 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviated terms
5 Information security objectives in healthcare and PHDs
6 Security vulnerabilities and threats of PHDs
6.1 Security vulnerabilities of PHDs
6.2 Security threats of PHDs
7 Identification and authentication for connectable PHDs
7.1 General
7.2 Person or entity identification and authentication
7.2.1 Objectives
7.2.2 User or entity registration procedure
7.2.3 Device identification and authentication
7.2.4 Human user identification and authentication
7.2.5 Authentication information management
7.3 Application, identification and authentication
7.3.1 Objectives
7.3.2 Unique Identification and Authentication
7.3.3 Application, firmware and information integrity
7.3.4 Secure upgrade
7.3.5 Input validation
7.3.6 Information confidentiality
7.4 Access control
7.4.1 Objectives
7.4.2 Secure log-on procedures
7.4.3 Emergency account
7.4.4 Automatic log-off
7.4.5 Device lock
Annex A (informative) Mapping to other standards
Bibliography
Keep me up-to-date
Register to receive notifications when updates are made to this standard.
Related Information
Similar Standards
-
BS 30440:2023
Validation framework for the use of artificial intelligence (AI) within healthcare. Specification
-
BS EN 1064:2020
Health informatics. Standard communication protocol. Computer-assisted electrocardiography
-
BS EN 1068:2005
Health informatics. Registration of coding systems
-
BS EN 12251:2004
Health informatics. Secure user identification for health care. Management and security of authentication by passwords
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviated terms
5 Information security objectives in healthcare and PHDs
6 Security vulnerabilities and threats of PHDs
6.1 Security vulnerabilities of PHDs
6.2 Security threats of PHDs
7 Identification and authentication for connectable PHDs
7.1 General
7.2 Person or entity identification and authentication
7.2.1 Objectives
7.2.2 User or entity registration procedure
7.2.3 Device identification and authentication
7.2.4 Human user identification and authentication
7.2.5 Authentication information management
7.3 Application, identification and authentication
7.3.1 Objectives
7.3.2 Unique Identification and Authentication
7.3.3 Application, firmware and information integrity
7.3.4 Secure upgrade
7.3.5 Input validation
7.3.6 Information confidentiality
7.4 Access control
7.4.1 Objectives
7.4.2 Secure log-on procedures
7.4.3 Emergency account
7.4.4 Automatic log-off
7.4.5 Device lock
Annex A (informative) Mapping to other standards
Bibliography