ISO/TR 22696:2020
Health informatics — Guidance on the identification and authentication of connectable Personal Healthcare Devices (PHDs)
The document gives guidance for managing healthcare service security using connectable personal health devices. This document considers unidirectional data uploading from the PHD to the gateway (manager device), however, there are many clinical use cases for bidirectional data exchange.
This document is applicable to identification and authentication between the bidirectionally connected PHDs and gateway by providing possible use cases and the associated threats and vulnerabilities. Since some smart devices with mobile healthcare apps and software might connect to the healthcare service network, these devices will be considered connectable PHDs in this document. This document addresses those devices used in a homecare setting, where the knowledge and capabilities regarding the use of PHDs might not be as advanced as in other healthcare settings.
This document excludes specific protocols, methods and technical solutions for identification and authentication.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$190.00 NZD
|
|
| HardCopy |
$238.00 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviated terms
5 Information security objectives in healthcare and PHDs
6 Security vulnerabilities and threats of PHDs
6.1 Security vulnerabilities of PHDs
6.2 Security threats of PHDs
7 Identification and authentication for connectable PHDs
7.1 General
7.2 Person or entity identification and authentication
7.2.1 Objectives
7.2.2 User or entity registration procedure
7.2.3 Device identification and authentication
7.2.4 Human user identification and authentication
7.2.5 Authentication information management
7.3 Application, identification and authentication
7.3.1 Objectives
7.3.2 Unique Identification and Authentication
7.3.3 Application, firmware and information integrity
7.3.4 Secure upgrade
7.3.5 Input validation
7.3.6 Information confidentiality
7.4 Access control
7.4.1 Objectives
7.4.2 Secure log-on procedures
7.4.3 Emergency account
7.4.4 Automatic log-off
7.4.5 Device lock
Annex A (informative) Mapping to other standards
Bibliography
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
BS 30440:2023
Validation framework for the use of artificial intelligence (AI) within healthcare. Specification
-
BS 8684:2024
Technology enabled care. Assessment of user needs and risks, system design, installation and maintenance. Code of practice
-
BS EN 1064:2020
Health informatics. Standard communication protocol. Computer-assisted electrocardiography
-
BS EN 1068:2005
Health informatics. Registration of coding systems
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviated terms
5 Information security objectives in healthcare and PHDs
6 Security vulnerabilities and threats of PHDs
6.1 Security vulnerabilities of PHDs
6.2 Security threats of PHDs
7 Identification and authentication for connectable PHDs
7.1 General
7.2 Person or entity identification and authentication
7.2.1 Objectives
7.2.2 User or entity registration procedure
7.2.3 Device identification and authentication
7.2.4 Human user identification and authentication
7.2.5 Authentication information management
7.3 Application, identification and authentication
7.3.1 Objectives
7.3.2 Unique Identification and Authentication
7.3.3 Application, firmware and information integrity
7.3.4 Secure upgrade
7.3.5 Input validation
7.3.6 Information confidentiality
7.4 Access control
7.4.1 Objectives
7.4.2 Secure log-on procedures
7.4.3 Emergency account
7.4.4 Automatic log-off
7.4.5 Device lock
Annex A (informative) Mapping to other standards
Bibliography