1. 7 February 2005IHE Europe Educational Event 1 Audit Trail and Node Authentication Integrating the Healthcare Enterprise G. Claeys Agfa Healthcare R&D Vendor Co-chair IHE Europe Courtesy of IHE Committees

2. 7 February 2005IHE Europe Educational Event 2 IHE IT Infrastructure 2004-2005 Enterprise User Authentication Provide users a single name and centralized authentication process across all systems Retrieve Information for Display Access a patient’s clinical information and documents in a format ready to be presented to the requesting user Retrieve Information for Display Access a patient’s clinical information and documents in a format ready to be presented to the requesting user Patient Identifier Cross-referencing for MPI Map patient identifiers across independent identification domains Patient Identifier Cross-referencing for MPI Map patient identifiers across independent identification domains Synchronize multiple applications on a desktop to the same patient Patient Synchronized Applications Consistent Time Coordinate time across networked systems Patient Demographics Query New Personnel White Page Access to workforce contact information New Cross-Enterprise Document Sharing Registration, distribution and access across health enterprises of clinical documents forming a patient electronic health record New Audit Trail & Node Authentication Centralized privacy audit trail and node to node authentication to create a secured domain. New

3. 7 February 2005IHE Europe Educational Event 3Scope Defines basic security features for a system in a healthcare enterprise in order to guarantee :  Only authorized persons have access to PHI (Protected Health Information)  Protect PHI against alteration, destruction and loss  Comply existing Privacy & Security regulations Extends the IHE radiology oriented Basic Security profile (2002) to be applicable to other healthcare uses.

4. 7 February 2005IHE Europe Educational Event 4Assumptions IHE ATNA transactions takes place in a secure domain  User/devices in secure domain adhere to security policy of hospital  Secure network is isolated from external networks through firewall  Intrusion detection systems are in place to detect violations Favor authentication & auditing over authorization

5. 7 February 2005IHE Europe Educational Event 5 Security Mechanism Authentication (user and device) Authorization Accountability (audit trails) Confidentiality Integrity ATNA, EUA ATNA

6. 7 February 2005IHE Europe Educational Event 6 ATNA - Security mechanism Device/User Authentication  “Who are you?”  Proof that the user/device is the one who it claims to be  ATNA features: Mutual device authentication over network, using certificates User authentication -> responsibility of implementation Authorization  “What are you allowed to do?”  Role based access control (RBAC)  ATNA features : Only authenticated users/devices can access PHI RBAC is on the IHE roadmap

7. 7 February 2005IHE Europe Educational Event 7 ATNA - Security mechanism (cont.) Accountability (audit trails)  “What have you done?”  Mechanisms to record and examine user/system activity  ATNA features : Audit message format + transport protocol Integrity  Proof that data has not been altered or destroyed in an unauthorized manner  ATNA features : TLS based network communication Confidentiality  Protection of PHI, transmitted or stored  Optional for intra-muros transmission  Required for extra-muros transmission  ATNA features : TLS option of AES

8. 7 February 2005IHE Europe Educational Event 8 IHE ATNA- Architecture System A System B Secured System Secure network Strong authentication of remote node (digital certificates) network traffic encryption is not required, it is optional Secured System Local access control (authentication of user) Audit trail with: Real-time access Time synchronization Central Audit Trail Repository

9. 7 February 2005IHE Europe Educational Event 9 IHE ATNA – New Actors Secure Node  Make an actor secure Audit Record Repository  Receives audit messages  Correlate audit information from different sources  Patient- or user- centric analysis  Filter&forward messages to enterprise audit repositories Time Server  Maintain reference time  Enables client application to synchronise their time

10. 7 February 2005IHE Europe Educational Event 10 IHE ATNA vs IHE Basic Security Focus on enterprise and not on radiology Support additional audit events (non- radiology related) Support additional audit event format  IETF format Support additional transport mechanism  Reliable syslog (cooked mode)

11. 7 February 2005IHE Europe Educational Event 11 Backward compatibility ATNA is backward compatible with Basic Security  Applications, supporting Basic Security are ATNA compliant Basic security is deprecated  No further extensions  New applications are encouraged to use new message format, transport mechanism

12. 7 February 2005IHE Europe Educational Event 12 All existing IHE actors need to be grouped with a Secure Node actor. Secure Node Audit Record Repository “Any” IHE actor Record Audit Event Time Server Secure Node Authenticate Node Maintain Time IHE ATNA – Actor and Transactions

13. 7 February 2005IHE Europe Educational Event 13 IHE ATNA – Transaction diagram

14. 7 February 2005IHE Europe Educational Event 14 Secure Node Local user authentication  Only needed at “client” node  Authentication mechanism User name and password (minimum) Biometrics, smart card  Secure nodes maintain list of authorized users : local or central (using EUA)  Security policy of hospital defines the relation between user and user id

15. 7 February 2005IHE Europe Educational Event 15 Secure Node (cont.) Mutual device authentication  Establish a trust relationship between 2 network nodes  Strong authentication by exchanging X.509 certificates  Certificates have a expiration date of 2 yr  Actor must be able to configure certificate list of trusted nodes. TCP/IP Transport Layer Security Protocol (TLS)  Used with DICOM/HL7/HTTP messages  Secure handshake protocol of both parties during Association establishment: Identify encryption protocol Exchange session keys  Supported cyphersuite : TLS_RSA_WITH_NULL_SHA (message signing, no encryption, default) TLS_RSA_WITH_AES_128_CBC_SHA (message signing + encryption, optional)

16. 7 February 2005IHE Europe Educational Event 16 What it takes to be a secure node The Secure node is not a simple add-on of an auditing capability. The larger work effort is:  Instrument all applications to detect auditable events and generate audit messages.  Ensure that all communications connections are protected (system hardening).  Establish a local security mechanism to protect all local resources  Establish configuration mechanisms for: Time synchronization Certificate management Network configuration Implement the audit logging facility

17. 7 February 2005IHE Europe Educational Event 17 Audit Record Repository Receives audit events from applications/actors accessing PHI ATNA defines  List of events that generate audit messages  Audit message format  Transport mechanism

18. 7 February 2005IHE Europe Educational Event 18 Audit Events Audit triggers are defined for every operation that access PHI (create, delete, modify, import/export) IHE TF describes the supported Audit Trigger per Actor Audit triggers are grouped on study level to minimize overhead

19. 7 February 2005IHE Europe Educational Event 19 IHE Audit Trail Events Combined list of IETF and DICOM events Actor-start-stop The starting or stopping of any application or actor. Audit-log-used Reading or modification of any stored audit log Begin-storing-instances The storage of any persistent object, e.g. DICOM instances, is begun Health-service-event Other health service related auditable event. Images-availability-query The query for instances of persistent objects. Instances-deleted The deletion of persistent objects. Instances-stored The storage of persistent objects is completed.

20. 7 February 2005IHE Europe Educational Event 20 IHE Audit Trail Events Combined list of IETF and DICOM events Medication Medication is prescribed, delivered, etc. Mobile-machine-event Mobile equipment is relocated, leaves the network, rejoins the network Node-authentication- failure An unauthorized or improperly authenticated node attempts communication Order-record-event An order is created, modified, completed. Patient-care-assignment Patient care assignments are created, modified, deleted. Patient-care-episode Auditable patient care episode event that is not specified elsewhere. Patient-record-event Patient care records are created, modified, deleted.

21. 7 February 2005IHE Europe Educational Event 21 IHE Audit Trail Events Combined list of IETF and DICOM events PHI-export Patient information is exported outside the enterprise, either on media or electronically PHI-import Patient information is imported into the enterprise, either on media or electronically Procedure-record-event The patient record is created, modified, or deleted. Query-information Any auditable query not otherwise specified. Security-administration Security alerts, configuration changes, etc. Study-object-event A study is created, modified, or deleted. Study-used A study is viewed, read, or similarly used.

22. 7 February 2005IHE Europe Educational Event 22 Audit Message Format Two audit message formats  IHE Radiology Provisional format, for backward compatibility with radiology  New ATNA format, for future growth Joint effort of IETF/DICOM/HL7/ASTM Draft version : http://www.ietf.org/rfc/rfc3881.txthttp://www.ietf.org/rfc/rfc3881.txt  Both formats are XML encoded messages, permitting extensions using XML standard extension mechanisms.  XSLT transformation is provided to convert “Provisional scheme” to “ATNA” scheme

23. 7 February 2005IHE Europe Educational Event 23 Audit Transport Mechanism Reliable Syslog – cooked mode  Preferred mechanism  RFC 3195  Connection oriented  Support certificate based authentication, encryption BSD Syslog protocol (RFC 3164) for backward compatibility

24. 7 February 2005IHE Europe Educational Event 24 Maintain Time transaction Network Time Protocol ( NTP) version 3 (RFC 1305) for time synchronization Required accuracy: 1 second Optionally Secure NTP may be used

25. 7 February 2005IHE Europe Educational Event 25 More information…. IHE Web sites: www.ihe.net www.ihe-europe.org Technical Frameworks: ITI V1.0, RAD V5.5, LAB V1.0 Technical Framework Supplements - Trial Implementation May 2004: Radiology August 2004: Cardiology, IT Infrastructure Non-Technical Brochures : Calls for Participation IHE Fact Sheet and FAQ IHE Integration Profiles: Guidelines for Buyers IHE Connect-a-thon Results Vendor Products Integration Statements