Overview

EN ISO 22600-2:2014 - Health informatics: Privilege management and access control, Part 2: Formal models defines formal, high‑level models that underpin privilege management and access control for distributed health information systems. Part 2 of the ISO 22600 series specifies component-based concepts to support technical implementation of cross‑domain healthcare information sharing and access control. It is based on ISO/IEC 10746 (all parts) and focuses on architecture and model definitions rather than clinical workflows or cryptographic protocols (these are out of scope).

Key topics and technical requirements

The standard introduces and formalizes multiple models used to express policies and enforce access control across policy domain boundaries:

Component paradigm - a component‑based approach for building interoperable access control services.
Domain model - structural representation of participating policy domains and actors.
Document model - classification and sensitivity metadata for health information objects.
Policy model - formal representation of access policies and policy agreements between parties.
Role model - definition of functional and structural roles and role relationships.
Authorization model - mechanisms for role-to-privilege assignment and authorization decisions.
Delegation model - rules and constraints for delegation of privileges between actors.
Control model & Access control model - formal control flows and access decision logic to evaluate requests across domains.

Other notable points:

Emphasis on policy bridging and interoperability where local authorization servers and cross‑border policy repositories coordinate access decisions.
Support for specifying purpose of use, requester identity, and target sensitivity in access decisions.
References to broader standards and profiles (ISO, CEN and other industry specifications) for integration.

Practical applications and users

EN ISO 22600-2 is intended for organizations and professionals designing secure, interoperable health IT systems that exchange sensitive patient data across organizational or national boundaries. Typical users include:

Health IT architects and solution designers implementing SOA or distributed EHR systems
Security engineers and access control implementers (authorization servers, policy repositories, directories)
System integrators and vendors building interoperable healthcare applications
Policy makers, privacy officers and technical leads drafting cross‑organization policy agreements
Healthcare organizations and insurers coordinating data sharing with unaffiliated providers

Implementing the formal models helps organizations manage complex role mappings, delegation, privacy constraints and legal/ethical considerations while improving interoperability and auditability.

Related standards

ISO 22600-1: Overview and policy management
ISO 22600-3: Implementations (examples/specifications)
ISO/IEC 10746 (all parts) - reference architecture background

Keywords: EN ISO 22600-2:2014, health informatics, privilege management, access control, formal models, policy model, role model, authorization, delegation, interoperability, healthcare information sharing.

Overview

Key topics and technical requirements

The standard introduces and formalizes multiple models used to express policies and enforce access control across policy domain boundaries:

Component paradigm - a component‑based approach for building interoperable access control services.
Domain model - structural representation of participating policy domains and actors.
Document model - classification and sensitivity metadata for health information objects.
Policy model - formal representation of access policies and policy agreements between parties.
Role model - definition of functional and structural roles and role relationships.
Authorization model - mechanisms for role-to-privilege assignment and authorization decisions.
Delegation model - rules and constraints for delegation of privileges between actors.
Control model & Access control model - formal control flows and access decision logic to evaluate requests across domains.

Other notable points:

Emphasis on policy bridging and interoperability where local authorization servers and cross‑border policy repositories coordinate access decisions.
Support for specifying purpose of use, requester identity, and target sensitivity in access decisions.
References to broader standards and profiles (ISO, CEN and other industry specifications) for integration.

Practical applications and users

Health IT architects and solution designers implementing SOA or distributed EHR systems
Security engineers and access control implementers (authorization servers, policy repositories, directories)
System integrators and vendors building interoperable healthcare applications
Policy makers, privacy officers and technical leads drafting cross‑organization policy agreements
Healthcare organizations and insurers coordinating data sharing with unaffiliated providers

Implementing the formal models helps organizations manage complex role mappings, delegation, privacy constraints and legal/ethical considerations while improving interoperability and auditability.

Related standards

ISO 22600-1: Overview and policy management
ISO 22600-3: Implementations (examples/specifications)
ISO/IEC 10746 (all parts) - reference architecture background

SIST EN ISO 22600-2:2015 PDF

Technical details

Abstract

Overview

Key topics and technical requirements

Practical applications and users

Related standards

Related standards

Abstract

Overview

Key topics and technical requirements

Practical applications and users

Related standards

Related standards

Health informatics — Privilege management and access control — Part 2: Formal models

Health informatics - Privilege management and access control - Part 1: Overview and policy management (ISO 22…

Information technology — Open Distributed Processing — Reference Model: Architecture

Health informatics - Privilege management and access control - Part 3: Implementations (ISO/DIS 22600-3:2014)