Overview - ISO 22600-1:2014 (Health informatics, Privilege management and access control)

ISO 22600-1:2014 defines high-level principles and services for privilege management and access control in health informatics, with a focus on secure health information exchange across organisational and policy domain boundaries. Part 1 provides an introduction to the framework, proposes a policy agreement template, and describes the documentation and governance needed to enable interoperable, auditable information sharing between unaffiliated providers, insurers, patients, staff and application systems. Cryptographic protocols and platform-specific implementation details are intentionally out of scope.

Key technical topics and requirements

ISO 22600-1 highlights component-based concepts and policy management requirements important for secure, cross-domain access control:

Policy agreement: template and clauses covering identification, patient consent, privacy, authorization and validity periods.
Authentication & identification: requirements for identifying principals (users and system agents).
Authorization and role structures: mapping roles, delegation rights, assignment and attestation authorities.
Information controls: identification, location, integrity and purpose-of-use rules for data access.
Policy repository & directory services: conceptual services for storing rules and identifying principals to support cross-border access.
Auditability and secure audit trail: logging, audit checks and documentation to support compliance and forensics.
Risk analysis & continuity: requirement to record risks, mitigation plans, disaster recovery and continuity management.
Documentation & governance: negotiation records, policy agreements, and templates (Annex A/B examples in the standard).

Practical applications and who uses it

ISO 22600-1 is a practical reference for organizations designing or governing health information exchange:

Health IT architects & developers - use the conceptual services and policy templates to design interoperable access-control solutions.
Security & privacy officers - base policy agreements, risk analyses and audit requirements on the standard.
Healthcare providers & hospitals - define cross-organization sharing rules (consent, purpose-of-use, role translations).
Health insurers & regional/national authorities - harmonize access policies across domains and jurisdictions.
Vendors & integrators - align implementations with Parts 2 and 3 for formal models and concrete implementations.

Practical uses include drafting interoperable policy agreements, mapping role-based access across organisations, documenting consent and privacy controls, and establishing audit and continuity requirements for shared electronic health records.

Related standards

ISO 22600 series: Part 2 (Formal models) and Part 3 (Implementations)
Other ISO/TC 215 references: ISO 17090, ISO 22857, ISO 21091, ISO 21298 - for complementary identity, security and directory specifications.

Keywords: ISO 22600-1, privilege management, access control, health informatics, policy agreement, health information exchange, role-based access control, patient consent, audit trail.

Overview - ISO 22600-1:2014 (Health informatics, Privilege management and access control)

Key technical topics and requirements

ISO 22600-1 highlights component-based concepts and policy management requirements important for secure, cross-domain access control:

Policy agreement: template and clauses covering identification, patient consent, privacy, authorization and validity periods.
Authentication & identification: requirements for identifying principals (users and system agents).
Authorization and role structures: mapping roles, delegation rights, assignment and attestation authorities.
Information controls: identification, location, integrity and purpose-of-use rules for data access.
Policy repository & directory services: conceptual services for storing rules and identifying principals to support cross-border access.
Auditability and secure audit trail: logging, audit checks and documentation to support compliance and forensics.
Risk analysis & continuity: requirement to record risks, mitigation plans, disaster recovery and continuity management.
Documentation & governance: negotiation records, policy agreements, and templates (Annex A/B examples in the standard).

Practical applications and who uses it

ISO 22600-1 is a practical reference for organizations designing or governing health information exchange:

Health IT architects & developers - use the conceptual services and policy templates to design interoperable access-control solutions.
Security & privacy officers - base policy agreements, risk analyses and audit requirements on the standard.
Healthcare providers & hospitals - define cross-organization sharing rules (consent, purpose-of-use, role translations).
Health insurers & regional/national authorities - harmonize access policies across domains and jurisdictions.
Vendors & integrators - align implementations with Parts 2 and 3 for formal models and concrete implementations.

Related standards

ISO 22600 series: Part 2 (Formal models) and Part 3 (Implementations)
Other ISO/TC 215 references: ISO 17090, ISO 22857, ISO 21091, ISO 21298 - for complementary identity, security and directory specifications.

Keywords: ISO 22600-1, privilege management, access control, health informatics, policy agreement, health information exchange, role-based access control, patient consent, audit trail.

ISO 22600-1:2014 PDF

Technical details

Abstract

Overview - ISO 22600-1:2014 (Health informatics, Privilege management and access control)

Key technical topics and requirements

Practical applications and who uses it

Related standards

Related standards

Abstract

Overview - ISO 22600-1:2014 (Health informatics, Privilege management and access control)

Key technical topics and requirements

Practical applications and who uses it

Related standards

Related standards

Health informatics - Privilege management and access control - Part 1: Overview and policy management (ISO 22…

Health informatics — Public key infrastructure — Part 1: Overview of digital certificate services

Health informatics — Guidelines on data protection to facilitate trans-border flows of personal health inform…

Health informatics - Directory services for healthcare providers, subjects of care and other entities (ISO 21…

Health informatics - Functional and structural roles (ISO 21298:2017, Corrected version 2017-04)