ASTM E2212-02a
(Practice)Standard Practice for Healthcare Certificate Policy
Standard Practice for Healthcare Certificate Policy
SCOPE
1.1 This practice covers a policy ("the policy") for digital certificates that support the authentication, authorization, confidentiality, integrity, and nonrepudiation requirements of persons and organizations that electronically create, disclose, receive, or otherwise transact health information.
1.2 This practice defines a policy for three classes of certificates: (1) entity certificates issued to computing components such as servers, devices, applications, processes, or accounts reflecting role assignment; (2) basic individual certificates issued to natural persons involved in the exchange of health information used for healthcare provisioning; and (3) clinical individual certificates issued to natural persons and used for authentication of prescriptive orders relating to the clinical treatment of patients.
1.3 The policy defined by this practice covers: (1) definition of healthcare certificates, healthcare certification authorities, healthcare subscribers, and healthcare relying parties; (2) appropriate use of healthcare certificates; ( 3) general conditions for the issuance of healthcare certificates; (4) healthcare certificate formats and profile; and (5) requirements for the protection of key material.
1.4 The policy establishes minimum responsibilities for healthcare certification authorities, relying parties, and certificate subscribers.
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
An American National Standard
Designation: E2212 – 02a
Standard Practice for
1
Healthcare Certificate Policy
This standard is issued under the fixed designation E2212; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope tificate Policy and Certification Practices Framework, P-
5
KIX Working Group Internet Draft, January 3, 2002
1.1 This practice covers a policy (“the policy”) for digital
RFC2560—InternetX.509PublicKeyInfrastructureOnline
certificates that support the authentication, authorization, con-
6
Certificate Status Protocol, OCSP, June 1999
fidentiality, integrity, and nonrepudiation requirements of per-
sons and organizations that electronically create, disclose,
3. Terminology
receive, or otherwise transact health information.
3.1 Certificate and Related Terms—A certificate, also re-
1.2 This practice defines a policy for three classes of
ferred to as a digital certificate or public key certificate, binds
certificates: (1) entity certificates issued to computing compo-
a public key value to information identifying the entity
nents such as servers, devices, applications, processes, or
associated with the use of a corresponding private key. An
accounts reflecting role assignment; (2) basic individual cer-
entity may be an individual, organization, account, role,
tificates issued to natural persons involved in the exchange of
computer process, or device. The entity identified within the
health information used for healthcare provisioning; and (3)
certificateisreferredtoasthecertificatesubject.Thecertificate
clinical individual certificates issued to natural persons and
is typically used to verify the digital signature of the certificate
used for authentication of prescriptive orders relating to the
subject or to encrypt information for that subject. The reliabil-
clinical treatment of patients.
ity of the binding of a public key to a certificate subject is
1.3 The policy defined by this practice covers: (1) definition
asserted by the certification authority (CA) that creates, issues,
of healthcare certificates, healthcare certification authorities,
and distributes certificates. Certification authority is synony-
healthcare subscribers, and healthcare relying parties; (2)
mous with certificate authority. Parties that depend on the
appropriate use of healthcare certificates; (3) general condi-
accuracy of information in the certificate are referred to as
tions for the issuance of healthcare certificates; (4) healthcare
relying parties. Certificate users are the collective relying
certificate formats and profile; and (5) requirements for the
parties and subscribers.
protection of key material.
3.2 Certificate Policy:
1.4 The policy establishes minimum responsibilities for
3.2.1 The X.509 standard defines a certificate policy (CP) as
healthcare certification authorities, relying parties, and certifi-
“a named set of rules that indicates the applicability of a
cate subscribers.
certificatetoaparticularcommunityand/orclassofapplication
2. Referenced Documents withcommonsecurityrequirements.”Forexample,aparticular
2 certificate policy might indicate the type of certificate appli-
2.1 ASTM Standards:
cable for authenticating electronic data interchange transac-
E2084 Specification forAuthentication of Healthcare Infor-
32 tions for the trading of goods within a specified price range. In
mation Using Digital Signatures
3
contrast, Practice E2212 addresses rules for certificates that
E2086 Guide for Internet and Intranet Healthcare Security
support the authentication, authorization, confidentiality, integ-
2.2 Other Documents:
rity, and nonrepudiation requirements of persons and organi-
Public Law 104-191, Aug. 21, 1996, Health Insurance
4 zations that electronically create, disclose, receive, or other-
Portability and Accountability Act of 1996
wise transact health information.
RFC 2527—Internet X.509 Public Key Infrastructure Cer-
3.2.2 Certificates contain a registered certificate policy ob-
ject identifier (OID) that the relying party may use to decide
1
This practice is under the jurisdiction ofASTM Committee E31 on Healthcare
whether a certificate may be trusted for a particular purpose.
Informatics , and is the direct responsibility of Subcommittee E31.25 on Healthcare
The OID registration process follows the procedures specified
Data Management, Security, Confidentiality, and Privacy.
inISO/IECandITUstandards.ThepartythatregisterstheOID
Current edition approved Nov. 10, 2002. Published January 2003. Originally
approved in 2002. Last previous edition approved in 2002 as E2212–02. DOI: also publishes the CP for examination by certificate users
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.