The Markle Foundation has just helped launch what can best be described as the first REAL effort at designing a framework for organizing healthcare information online. This project is backed by some pretty heavy parties on both the tech side (Google, Microsoft, Intuit, WebMD, etc) and on the provider side (Aetna, BCBS, Department of Veteran Affairs, etc). The framework is designed to establish a common set of “best practices” that should be followed by applications and services that handle, process, or store personal health-related data online. According to Markle : The framework …includes four overviews and 14 specific technology and policy approaches for consumers to access health services, to obtain and control copies of health information about them, to authorize[…]
Category: standards
There’s an old saying that the great thing about standards is that there are so many to choose from. This is clearly evident in the Health Care IT arena. The standards landscape is getting a little crowded, despite the fact that the push to actually integrate and support these standards seems to take a back seat to refining and creating more and more of them. Right now, I’m dealing with several of these standards at once – SAFE, XAdES and CDISC ODM to be specific. And, this is just a tiny fraction of the health care IT standards collection – there are more than 200 entries on the so-called “short list” of standards that apply to electronic records in the[…]
This week brought with it the exciting news that Exostar is launching a federated identity service for the aerospace industry. Next week, however, Exostar will launch a new capability, the Federated Identity Service, that does the process of “credentialing” on behalf of Exostar’s members, ensuring that individuals that attempt to use the systems of the community or its members are who they say they are — and are authorized to use the systems they are trying to access. The concept behind federated identity is a simple one. Leverage existing investments providing identification / authentication of users, and build an authorization structure that works across multiple applications, systems, companies, and vertical markets. The U.S. Government has their E-Authentication initiative, there are[…]
I was at the Microsoft Health and Life Sciences Developer Conference last week in Atlantic City, where I got the chance to listen to a good presentation from Les Jordan of Microsoft about 21 CFR Part 11 compliance. The talk centered around how Microsoft is trying to make dealing with the V Model more manageable for validated application as it pertains to applying security patches. One interesting point that was made was that if there is a security patch available for a validated system, and that patch has not been applied to that system, then the system is not considered by the FDA to be compliant. However, full qualification tests must be run and documented while applying the patch, which[…]
ISO 17090:2008 Parts 1-3 were released on February 14. But is this a new standard or just a rehash of existing standards? ISO 17090 is not new (previously released in 2002), but there’s no clear indication on how it has changed. ISO 17090 sets out PKI standards and interoperability requirements for the healthcare industry – including certificate profiles, CPs, etc. I’d love to be able to read those standards (they’re about $125 each) to see how they compare to already existing standards such as SAFE and the Federal Bridge PKI. SAFE’s bridge is explicitly for the healthcare industry, but complies with the Federal Bridge certificate policies which spans multiple industries. Has the new updated version taken into account these existing[…]
The IESG secretary has announced a proposed recharter of the IETF PKIX working group. The PKIX Working Group was established in the fall of 1995 with the goal of developing Internet standards to support X.509-based Public Key Infrastructures (PKIs). Initially PKIX pursued this goal by profiling X.509 standards… most PKIX-generated RFCs are no longer profiles of ITU-T X.509 documents. PKIX is now seeking to redefine itself not solely by its profiling of ITU-T standards, but also developing standards that are useful for PKI and related systems. An example of this type of RFC is the informational RFC 4158, Internet X.509 Public Key Infrastructure: Certification Path Building, which I co-authored and edited. It fills a need not expressed by any ITU[…]