Overview
EN ISO 22600-3:2014 (Health informatics - Privilege management and access control - Part 3: Implementations) defines implementation-level guidance for managing privileges and access control in distributed health information systems. Building on ISO 22600-1 (overview/policy management) and ISO 22600-2 (formal models), Part 3 specifies requirements for repositories of access control policies and for privilege management infrastructures (PMI), and provides practical implementation examples of the formal models. The standard focuses on secure, privacy-aware health information exchange across policy domain boundaries - from local systems to regional or national health information exchanges.
Key Topics and Requirements
- Privilege management infrastructure (PMI) requirements - guidance for components and services needed to manage privileges across organizations.
- Repositories for access control policies - requirements for storing, managing and retrieving policy artifacts used in authorization decisions.
- Interpretation of formal models - practical instantiations of the models defined in ISO 22600-2 for healthcare settings.
- Policy representation and constraint modelling - use of domain languages, OCL (Object Constraint Language) modelling and other constraint representations to express rules.
- Consent management - patient consent concepts and management approaches for integrating consent into access control decisions.
- Emergency access (break-glass) - considerations for handling urgent access scenarios while preserving auditability and policy constraints.
- Refinements for control and delegation models - implementation-level guidance on control flows and delegation of privileges.
- Ancillary topics - attribute certificate extensions, terminology alignment, and worked examples for policy management and representation (informative annexes).
Applications and Practical Value
EN ISO 22600-3 is intended for organizations and projects that need interoperable, standards-based access control for health information exchange. Typical applications:
- Implementing role- and attribute-based access control across unaffiliated providers and health information exchanges (HIEs).
- Designing privilege management infrastructures that support cross-domain authorization and delegation.
- Integrating patient consent and emergency access policies into electronic health record (EHR) systems.
- Creating policy repositories and tooling for policy lifecycle management (authoring, storing, distributing, evaluating).
Who uses it:
- Health IT architects and system integrators
- EHR vendors and software developers
- Security and privacy officers in hospitals, insurers and HIEs
- National/regional health authorities and standards bodies
Related Standards
- ISO 22600-1: Overview and policy management
- ISO 22600-2: Formal models (models implemented by Part 3)
- References to other standards and specifications (ISO, CEN, ASTM, OMG, W3C) for interoperability and security building blocks
EN ISO 22600-3 helps standardize privilege management, access control, policy representation, and consent integration to enable secure, privacy-aware health information exchange across organizational and national boundaries.
