prCEN ISO/TS 14441-1

Health informatics - Security and Privacy Requirements for Compliance - Testing of EHR Systems - Part 1: Foundation prCEN ISO/TS 14441-1

Scope

This New Work Item Proposal addresses security and privacy protection in those point-of-care electronic patient record that are inter-operable with EHR systems. It does so by providing:
- a set of core security and privacy requirements, along with the guidelines and best practices necessary for implementing compliance and testing programs to assure compliance with those requirements;
- a profile of these core requirements, including examples of proven testing procedures that have been developed to evaluate compliance for electronic patient record systems in community-based physician offices.
This will be a multi-part technical specification, as new profiles may be developed for other targets of evaluation.
PART 1 will include core security and privacy requirements (including a technical description of the requirements that must be met to ensure that information is protected as well as the main categories of attack); a discussion of the theoretical foundations underpinning the requirements; guidance on best practice for establishing and maintaining compliance programs; and a description of the compliance process, including the compliance statement, business models for compliance, testing procedures and test environment, versioning, and issues related to education, training and awareness. An informative annex will provide examples of existing compliance programs in various jurisdictions.
A summary outline is attached to the proposal.
Part 2: "Protection profile for small scale patient health record systems" is described in a separate form 4.
Scope Exclusions: Policies and procedural or administrative