ASTM E1762-95(2009)

Standard Guide for Electronic Authentication of Health Care Information

SIGNIFICANCE AND USE
This guide serves three purposes:
To serve as a guide for developers of computer software providing, or interacting with, electronic signature processes,
To serve as a guide to healthcare providers who are implementing electronic signature mechanisms, and
To be a consensus standard on the design, implementation, and use of electronic signatures.
SCOPE
1.1 This guide covers:
1.1.1 Defining a document structure for use by electronic signature mechanisms (Section 4),
1.1.2 Describing the characteristics of an electronic signature process (Section 5),
1.1.3 Defining minimum requirements for different electronic signature mechanisms (Section 5),
1.1.4 Defining signature attributes for use with electronic signature mechanisms (Section 6),
1.1.5 Describing acceptable electronic signature mechanisms and technologies (Section 7),
1.1.6 Defining minimum requirements for user identification, access control, and other security requirements for electronic signatures (Section 9), and
1.1.7 Outlining technical details for all electronic signature mechanisms in sufficient detail to allow interoperability between systems supporting the same signature mechanism (Section 8 and Appendix X1-Appendix X4).
1.2 This guide is intended to be complementary to standards under development in other organizations. The determination of which documents require signatures is out of scope, since it is a matter addressed by law, regulation, accreditation standards, and an organization's policy.
1.3 Organizations shall develop policies and procedures that define the content of the medical record, what is a documented event, and what time constitutes event time. Organizations should review applicable statutes and regulations, accreditation standards, and professional practice guidelines in developing these policies and procedures.

General Information

• Status: Historical
• Publication Date: 31-Mar-2009
• ICS: 11.020 - Medical sciences and health care facilities in general
• ICS: 35.240.80 - IT applications in health care technology
• Technical Committee: E31 - Healthcare Informatics
• Drafting Committee: E31.25 - Healthcare Data Management, Security, Confidentiality, and Privacy

Relations

• Replaces: ASTM E1762-95(2003) - Standard Guide for Electronic Authentication of Health Care Information
• Effective Date: 01-Apr-2009
• Replaced By: ASTM E1762-95(2013) - Standard Guide for Electronic Authentication of Health Care Information (Withdrawn 2017)
• Effective Date: 01-Mar-2013

Standards Content (Sample)

NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: E1762 − 95(Reapproved 2009) An American National Standard
Standard Guide for
1
Electronic Authentication of Health Care Information
This standard is issued under the fixed designation E1762; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope ISO 8825-1 1993: Specification of Basic Encoding Rules for
2
ASN.1
1.1 This guide covers:
2
ISO 7816 1993: IC Cards with Contacts
1.1.1 Defining a document structure for use by electronic
2
ISO 10036 1994: Contactless IC Cards
signature mechanisms (Section 4),
2.2 ANSI Standards:
1.1.2 Describing the characteristics of an electronic signa-
ANSI X9.30 Part 3: Certificate Management for DSA, No-
ture process (Section 5),
3
vember 1994 (ballot copy)
1.1.3 Defining minimum requirements for different elec-
ANSI X9.31 Part 3: Certificate Management for RSA, July
tronic signature mechanisms (Section 5),
3
1994 (draft)
1.1.4 Defining signature attributes for use with electronic
ANSI X9.31 Part 1: RSA Signature Algorithm, July 1994
signature mechanisms (Section 6),
3
(ballot copy) (technically aligned with ISO/IEC 9796)
1.1.5 Describing acceptable electronic signature mecha-
ANSI X9.30 Part 1: Digital Signature Algorithm, July 1994
nisms and technologies (Section 7),
(ballot copy) (technically aligned with NIST FIPS PUB
1.1.6 Defining minimum requirements for user
3
186)
identification, access control, and other security requirements
ANSI X9F1, ANSI X9.45: Enhanced Management Controls
for electronic signatures (Section 9), and
3
Using Attribute Certificates, September 1994 (draft)
1.1.7 Outlining technical details for all electronic signature
mechanisms in sufficient detail to allow interoperability be-
2.3 Other Standards:
4
tween systems supporting the same signature mechanism
FIPS PUB 112: Standards on Password Usage, May 1985
(Section 8 and Appendix X1-Appendix X4).
FIPS PUB 181: Secure Hash Standard, 1994 (technically
4
aligned with ANSI X9.30–1)
1.2 This guide is intended to be complementary to standards
FIPS PUB 186: Digital Signature Standard, 1994 (techni-
under development in other organizations. The determination
4
cally aligned with ANSI X9.30–1)
of which documents require signatures is out of scope, since it
PKCS #1: RSA Encryption Standard (version 1.5), Novem-
is a matter addressed by law, regulation, accreditation
5
ber 1993
standards, and an organization’s policy.
5
PKCS #5: Password-Based Encryption Standard, 1994
1.3 Organizations shall develop policies and procedures that
5
PKCS #7: Cryptographic Message Syntax Standard, 1994
define the content of the medical record, what is a documented
event, and what time constitutes event time. Organizations
3. Terminology
shouldreviewapplicablestatutesandregulations,accreditation
3.1 Definitions:
standards, and professional practice guidelines in developing
3.1.1 access control—the prevention of unauthorized use of
these policies and procedures.
a resource, including the prevention of use of a resource in an
2. Referenced Documents unauthorized manner.
3.1.2 accountability—the property that ensures that the
2.1 ISO Standards:
actions of an entity may be traced uniquely to the entity.
ISO9594-8 1993:TheDirectory:AuthenticationFramework
2
(also available as ITU-S X.509)
3.1.3 attribute—a piece of information associated with the
use of a document.
1
This guide is under the jurisdiction of ASTM Committee E31 on Healthcare
Informatics and is the direct responsibility of Subcommittee E31.25 on Healthcare
3
Data Management, Security, Confidentiality, and Privacy. Available from American National Standards Institute (ANSI), 25 W. 43rd St.,
Current edition approved April 1, 2009. Published September 2009. Originally 4th Floor, New York, NY 10036, http://www.ansi.org.
4
approved in 1995. Last previous edition approved in 2003 as E1762–95 (2003). Available from National Institute of Standards and Technology (NIST), 100
DOI: 10.1520/E1762-95R09. Bureau Dr., Stop 1070, Gaithersburg, MD 20899-1070, http://www.nist.gov.
2 5
Available from ISO, 1 Rue de Varembe, Case Postale 56, CH 1211, Geneve, Available from RSA Data Security, 100 Marine Parkway, Redwood City, CA
Switzerland. 64065.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1

---------------------- Page: 1 ----------------------
E1762 − 95 (2009)
3.1.4 attribute certificate—a digitally signed data structure 3.1.22 private key—a key in an asymmetric algorithm; the
that binds a user to a set of attributes. possession of this key is restricted, usually to one entity.
3.1.5 authorization—verificati
...