The World Internet Security Company ID Management in e-Health February 2007

The World Internet Security Company About WISeKey Company founded in 1999 Privately held Headquarters in Geneva, Switzerland Trust services hosted in our highly secure datacenters Affiliates around the world, including Bulgaria for Eastern Europe Solutions deployed in over 20 countries Strong technological alliances in the e-Health sector

The World Internet Security Company Recent Misuses of Patient Health Information Banker collects On Cancer Patients Mortgages Hospital Employee Sells Country Singers Medical Records for $2610 Psychological records of 62 children accidentally posted on website Physicians Laptop with patient medical histories stolen health.org exposes customer names, addresses, phone numbers & addresses on web Washington DC Hospital Fined $25,000 Sick employee fired by self-insured employer

The World Internet Security Company Risks in the e-Health World Wrongful access to patient or medical information Theft of physicians laptops and data Posting of confidential data on rogue websites Breach of doctor-patient secrecy through the interception of electronic communications Failure to comply with regulations due to weak security

The World Internet Security Company What is Identity for eHealth? People –Employees –Patients –Partners –Suppliers Material –Computers –Medical Supplies –Drugs –Surgical Equipment

The World Internet Security Company Need for e-Identity

The World Internet Security Company Patient Centric Model

The World Internet Security Company Digital Identity

The World Internet Security Company Identity and healthcare Regulations mandate protection of patient health information Protection defined (technical security services) Access control – what you can access Audit control – what you have accessed Authorization control – what you can do once you access Data integrity – ensuring data is intact Entity authentication - proving your identity Once again, it all comes back to Identity

The World Internet Security Company

Core PKI Services essential assurance to an entity that data has not been altered between there and here or between then and now assurance to an entity that no one can read a particular piece of data except the intended receiver assurance to one entity that another entity is who he, she, or it claims to be a public key infrastructure (PKI) is an arrangement that provides for trusted third partys vouching for user identities Integrity Confidentiality Authentication

The World Internet Security Company Use of Trusted Certificates Data Encryption Intranet/Extranet Access Management Mobile Data Encryption Digital Identity Digital Signature encryption And signature Access Control User management

The World Internet Security Company Strong Application Authentication Web Based Portal Patient Encrypted HTTPS Tunnel Through the use of a WISeKey Trusted Certificate incorporated on a smart- card/token, the patient is able to authenticate himself in safer and stronger ways in order to access web- based portals Secure Zone Electronic Patient Records E-Prescriptions Data Repository E-Prescriptions Data Repository Health Insurance Service Custom Hospital Application

The World Internet Security Company Secure Communications Data Encryption and digital signature of s with WISeKey Certificates Assurance of the Authenticity of the Sender and the integrity of the message The right people see the right information Doctors Health Insurances Government Hospitals

The World Internet Security Company Guaranteed Data Integrity Patient sends Data XYZ Doctor receives Data XYZ Internet/Extrane t By using WISeKey solutions, we are able to guarantee the integrity of data sent between two parties. This is crucial when exchanging data in such instances as e-Prescriptions. Prevents man in the middle attacks By using WISeKey solutions, we are able to guarantee the integrity of data sent between two parties. This is crucial when exchanging data in such instances as e-Prescriptions. Prevents man in the middle attacks Safe Zone

The World Internet Security Company Digital Form Signing Non-compliant Digital Forms Digital Signature using a WISeKey Certificate Compliant Form Digital Signatures permit the legal endorsement of such documents as electronic patient records, lab orders, prescriptions and requisitions thus helping compliance with different EU and country based directives.

The World Internet Security Company Regulatory compliance By combining WISeKeys technologies with secure infrastructures and policies, you are able to better reach compliance with such directives as: – HIPPA – SAFE – EU Directive 2004/9/CE – Swiss Data Protection Law And others By combining WISeKeys technologies with secure infrastructures and policies, you are able to better reach compliance with such directives as: – HIPPA – SAFE – EU Directive 2004/9/CE – Swiss Data Protection Law And others

The World Internet Security Company Foreseen Swiss Model Identification StandardCertificate Authentication Non-Repudiation AdvancedCertificate

The World Internet Security Company Contact us 8, Tzar Ivan Shishman st Sofia, Bulgaria Tel Fax: