Overview
EN ISO 13606-4:2019 - Health informatics: Electronic health record communication - Part 4: Security specifies a methodology for defining and communicating the privileges required to access parts of an Electronic Health Record (EHR). As part of the ISO 13606 series, this part focuses on EHR-specific access control and audit information that informs access decisions during EHR communication between systems while pointing to general security requirements and technical solutions. It replaces the 2007 edition and aligns audit logging with ISO 27789.
Key Topics and Requirements
- Access policy model: A structured approach for representing access policies within an EHR_EXTRACT, including an archetype for an access policy COMPOSITION.
- Record component sensitivity: Rules for labeling EHR components with sensitivity metadata that guide access decisions.
- Functional roles: Standardized vocabulary for roles (clinicians, researchers, managers, etc.) and rules for mapping roles to sensitivity and access privileges.
- Policy elements: Representation of policy targets, request criteria, sensitivity constraints, and attestation information to support fine‑grained, context-aware access control.
- Audit log model: A communication-oriented audit trail format (EHR audit log extract and entries) aligned with ISO 27789, containing information about the extract being communicated for compliance and traceability.
- Conformance and extensibility: Guidance on how jurisdictions can nominate alternative or specialized role terms and how implementations can conform to the model.
- Scope constraints: Focuses on security aspects specific to EHR communication; security requirements unrelated to EHR communication fall outside the scope.
Practical Applications
- Designing and implementing EHR interoperability solutions that require secure, auditable record exchange across organizations or borders.
- Embedding access-control metadata within EHR extracts so receiving systems can enforce patient-specified or jurisdictional policies in real time.
- Creating audit and compliance workflows that transmit EHR access logs for regulatory reporting, incident investigation, or cross‑system accountability.
- Supporting consent management and patient-controlled disclosure by mapping patient preferences to access policies used during EHR communication.
Who Should Use This Standard
- Health informatics architects and EHR system designers
- Security architects and access control engineers in healthcare IT
- Health information exchange (HIE) implementers and integrators
- Privacy officers, auditors, and compliance teams
- Standards bodies and vendors building interoperable EHR communication solutions
Related Standards
- ISO 13606-1 (EHR communications architecture)
- ISO 27789 (EHR audit trails)
- ISO 22600-3 and ISO 22857 (consent and cross‑border considerations)
- National and regional health‑IT security regulations and conformance frameworks
Keywords: EN ISO 13606-4:2019, EHR security, electronic health record communication, access control, audit log, health informatics, EHR interoperability.
