CDA encryption Brief Profile Proposal for 2009/10 presented to the IT Infrastructure Planning Committee Martin Rosner, Paul Koster Sept 24, 2010

IT Infrastructure Planning Committee The Problem Lack of persistent end-to-end encryption for CDA documentsLack of persistent end-to-end encryption for CDA documents –Distributed heterogeneous environments with multiple intermediaries –Encryption currently at transport level (e.g. IHE ATNA, TLS, S/MIME) –Certain transports lack standard solutions (e.g. USB drive using IHE XDM) –Open document-level standard for encryption fosters interoperability –Similar document-level encryption already defined for imaging Need for enabling technology towards addressing meaningful use (HITECH), privacy legislation, and patient consent directives (IHE BPPC, HL7 Consent Directive)Need for enabling technology towards addressing meaningful use (HITECH), privacy legislation, and patient consent directives (IHE BPPC, HL7 Consent Directive) Continua Health Alliance, national health networks, etc. foreseen as possible adoptersContinua Health Alliance, national health networks, etc. foreseen as possible adopters

IT Infrastructure Planning Committee Third party opinion in tele-monitoring 1.DMO transfers encrypted CDA document to hospital in different affinity domain 2.Hospital GP accesses the document 3.GP forwards encrypted CDA document to expert specialist using IHE XDR 4.Expert specialist accesses document for 2 nd opinion Exchanging health records using USB drives 1.Doctor s record summary to patient as encrypted CDA document 2.Patient detaches document and saves it on his USB drive 3.Patient shares encrypted CDA document with healthcare providers Use Case

IT Infrastructure Planning Committee Proposed Standards & Systems Base standards for CDA document encryptionBase standards for CDA document encryption –HL7 CDA R2 –XML Encryption –maintain compatibility with IHE XD* family of profiles Key managementKey management –profile for key container and exchange –IHE HPD (Healthcare Provider Directory) may facilitate key management with support for certificates and public keys –X509V3, XML Encryption Synchronize approach with HL7Synchronize approach with HL7

IT Infrastructure Planning Committee Discussion Effort levelEffort level –known technology, but careful alignment and compatibility with related standards needed Profile editorsProfile editors –Martin Rosner, Philips, martin.rosner AT philips DOT com –Paul Koster, Philips, r.p.koster AT philips DOT com