iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
CEN

EN ISO/IEEE 11073-40101:2022

(Main)

Health informatics - Device interoperability - Part 40101: Foundational - Cybersecurity - Processes for vulnerability assessment (ISO/IEEE 11073-40101:2022)

Health informatics - Device interoperability - Part 40101: Foundational - Cybersecurity - Processes for vulnerability assessment (ISO/IEEE 11073-40101:2022)

Within the context of secure plug-and-play interoperability, cybersecurity is the process and capability of preventing unauthorized access or modification, misuse, denial of use, or the unauthorized use of information that is stored on, accessed from, or transferred to and from a PHD/PoCD. The process part of cybersecurity is risk analysis of use cases specific to a PHD/PoCD.
For PHDs/PoCDs, this standard defines an iterative, systematic, scalable, and auditable approach to identification of cybersecurity vulnerabilities and estimation of risk. This iterative vulnerability assessment uses the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) classification scheme and the embedded Common Vulnerability Scoring System (eCVSS). The assessment includes system context, system decomposition, pre-mitigation scoring, mitigation, and post-mitigation scoring and iterates until the remaining vulnerabilities are reduced to an acceptable level of risk.

Medizinische Informatik - Geräteinteroperabilität - Teil 40101: Grundlagen - Cybersicherheit - Prozess zur Schwachstellenanalyse (ISO/IEEE 11073-40101:2022)

Informatique de santé - Interopérabilité des dispositifs - Partie 40101: Fondamentaux - Cybersécurité - Processus pour l'évaluation de la vulnérabilité (ISO/IEEE 11073-40101:2022)

Dans le contexte de l'interopérabilité sécurisée de type prêt à l'emploi, la cybersécurité est le processus et la capacité d'empêcher l'accès ou la modification non autorisés, l'utilisation abusive, le déni d'utilisation ou l'utilisation non autorisée des informations qui sont stockées sur un PHD/PoCD, accessibles depuis celui-ci ou transférées vers et depuis celui-ci. La partie processus de la cybersécurité est l'analyse des risques des cas d'utilisation spécifiques à un PHD/PoCD.
Pour les PHD/PoCD, la présente norme définit une approche itérative, systématique, évolutive et auditable de l'identification des vulnérabilités en matière de cybersécurité et l'estimation des risques. Cette évaluation itérative des vulnérabilités utilise le schéma de classification STRIDE (usurpation d'identité, falsification, répudiation, divulgation d'informations, déni de service, élévation du privilège) et le Système d'évaluation des vulnérabilités courantes intégré (eCVSS). L'évaluation comprend le contexte du système, la décomposition du système, la notation avant atténuation, l'atténuation et la notation après atténuation et se répète jusqu'à ce que les vulnérabilités restantes soient réduites à un niveau de risque acceptable.

Zdravstvena informatika - Interoperabilnost naprav - 40101. del: Temeljno - Kibernetska varnost - Procesi ocenjevanja ranljivosti (ISO/IEEE 11073-40101:2022)

V okviru varne interoperabilnosti s takojšnjim učinkom (»vstavi in poženi«) je kibernetska varnost postopek in zmožnost preprečevanja nepooblaščenega dostopa ali spreminjanja, zlorabe, zavrnitve uporabe ali nepooblaščene uporabe informacij, ki so shranjene ali dostopne v osebnih zdravstvenih napravah/napravah na mestu oskrbe (PHD/PoCD) ali prenesene vanje ter iz njih. Procesni del kibernetske varnosti je analiza tveganja primerov uporabe, ki so značilni za osebne zdravstvene naprave/naprave na mestu oskrbe.
Ta standard opredeljuje iterativen, sistematičen, nadgradljiv in preverljiv pristop k določanju ranljivosti na področju kibernetske varnosti in ocenjevanju tveganja za osebne zdravstvene naprave/naprave na mestu oskrbe. Pri navedenem iterativnem ocenjevanju ranljivosti se uporabljata razvrstitvena shema STRIDE (Spoofing (slepljenje), Tampering (nedovoljeno spreminjanje), Repudiation (zavrnitev), Information Disclosure (razkritje podatkov), Denial of Service (zavrnitev storitve) in Elevation of Privilege (prisvojitev pravic)) in vdelani skupni sistem točkovanja ranljivosti (eCVSS). Ocena vključuje kontekst sistema, razčlenitev sistema, rezultat točkovanja pred ublažitvijo, ublažitev in rezultat točkovanja po ublažitvi ter se ponavlja, dokler stopnja tveganja za preostale ranljivosti ne postane sprejemljiva.

General Information

Status
Published
Publication Date
29-Mar-2022
Withdrawal Date
29-Sep-2022
ICS
35.240.80 - IT applications in health care technology
Technical Committee
CEN/TC 251 - Medical informatics
Drafting Committee
CEN/TC 251/WG 2 - Terminology and knowledge representation
Current Stage
6060 - Definitive text made available (DAV) - Publishing
Start Date
30-Mar-2022
Due Date
17-Jun-2024
Completion Date
30-Mar-2022
Ref Project
SIST EN ISO/IEEE 11073-40101:2022 - Health informatics - Device interoperability - Part 40101: Foundational - Cybersecurity - Processes for vulnerability assessment (ISO/IEEE 11073-40101:2022)

Buy Standard

EN ISO/IEEE 11073-40101:2022 - BARVEEN ISO/IEEE 11073-40101:2022 - BARVE
PreviousNext
Standard
EN ISO/IEEE 11073-40101:2022 - BARVE
English language
55 pages
sale 10% off
Preview
sale 10% off
Preview
e-Library read for
1 day

Standards Content (Sample)

SLOVENSKI STANDARD
SIST EN ISO/IEEE 11073-40101:2022
01-julij-2022
Zdravstvena informatika - Interoperabilnost naprav - 40101. del: Temeljno -
Kibernetska varnost - Procesi ocenjevanja ranljivosti (ISO/IEEE 11073-40101:2022)
Health informatics - Device interoperability - Part 40101: Foundational - Cybersecurity -
Processes for vulnerability assessment (ISO/IEEE 11073-40101:2022)
Informatique de santé - Interopérabilité des dispositifs - Partie 40101: Fondamentaux -
Cybersécurité - Processus pour l'évaluation de la vulnérabilité (ISO/IEEE 11073-
40101:2022)
Ta slovenski standard je istoveten z: EN ISO/IEEE 11073-40101:2022
ICS:
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
SIST EN ISO/IEEE 11073-40101:2022 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
SIST EN ISO/IEEE 11073-40101:2022

---------------------- Page: 2 ----------------------
SIST EN ISO/IEEE 11073-40101:2022


EN ISO/IEEE 11073-
EUROPEAN STANDARD
40101
NORME EUROPÉENNE

EUROPÄISCHE NORM

March 2022
ICS 35.240.80
English Version

Health informatics - Device interoperability - Part 40101:
Foundational - Cybersecurity - Processes for vulnerability
assessment (ISO/IEEE 11073-40101:2022)
Informatique de santé - Interopérabilité des dispositifs Medizinische Informatik - Geräteinteroperabilität - Teil
- Partie 40101: Fondamentaux - Cybersécurité - 40101: Grundlagen - Cybersicherheit - Prozess zur
Processus pour l'évaluation de la vulnérabilité Schwachstellenanalyse (ISO/IEEE 11073-40101:2022)
(ISO/IEEE 11073-40101:2022)
This European Standard was approved by CEN on 13 March 2022.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and
United Kingdom.





EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2022 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO/IEEE 11073-40101:2022 E
worldwide for CEN national Members.

---------------------- Page: 3 ----------------------
SIST EN ISO/IEEE 11073-40101:2022
EN ISO/IEEE 11073-40101:2022 (E)
Contents Page
European foreword . 3

2

---------------------- Page: 4 ----------------------
SIST EN ISO/IEEE 11073-40101:2022
EN ISO/IEEE 11073-40101:2022 (E)
European foreword
This document (EN ISO/IEEE 11073-40101:2022) has been prepared by Technical Committee ISO/TC
215 "Health informatics" in collaboration with Technical Committee CEN/TC 251 “Health informatics”
the secretariat of which is held by NEN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by September 2022, and conflicting national standards
shall be withdrawn at the latest by September 2022.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN website.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, S
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

CEN
EN ISO 21860:2024(Main)
Health Informatics - Reference standards portfolio (RSP) - Clinical imaging (ISO 21860:2020)
SIST EN ISO 21860:2024

This document establishes the Reference Standards Portfolio (RSP) for the clinical imaging domain (as defined in Clause 4).
An RSP lists the principle health information technology (HIT) standards that form the basis of implementing and deploying interoperable applications in the target domain.
An RSP includes a description of the domain, a normative list of standards, and an informative framework for mapping the standards to example deployment use cases.
The lists do not include standards that are specifically national in scope.
The primary target audience for this document is policy makers (governmental or organizational), regulators, project planners and HIT managers. This document will also be of interest to other stakeholders such as equipment and HIT vendors, clinical and health information management (HIM) professionals and standards developers.
The intended usage of this document is to inform decisions about selecting the standards that will form the basis of integration projects in geographic regions or healthcare organizations. For example:
—     What standards to use for capturing/encoding/exchanging certain types of information
—     What standards to use for interfaces between the devices and information systems that support information capture, management, exchange, processing and use
—     What standards to use for specific use cases/deployment scenarios
The selected standards, and/or corresponding RSP clauses, might be useful when drafting project specifications.

  • Draft
    56 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO 21549-7:2024(Main)
Health informatics - Patient healthcard data - Part 7: Medication data (ISO 21549-7:2024)
SIST EN ISO 21549-7:2024

This document applies to situations in which such data is recorded on or transported by patient healthcards compliant with the physical dimensions of ID-1 cards defined by ISO/IEC 7810.
This document specifies the basic structure of the data contained within the medication data object, but does not specify or mandate particular data sets for storage on devices.
The purpose of this document is for cards to provide information to other health professionals and to the patient or its non-professional caregiver.
It can also be used to carry a new prescription from the prescriber to the dispenser/pharmacy in the design of its sets.
Medication data include the following four components:
—     medication notes: additional information related to medication and the safe use of medicines by the patient such as medication history, sensitivities and allergies;
—     medication prescriptions: to carry a new prescription from the prescriber to the dispenser/pharmacy;
—     medication dispensed: the records of medications dispensed for the patient;
—     medication references: pointers to other systems that contain information that makes up medication prescription and the authority to dispense.
The following topics are beyond the scope of this document:
—     physical or logical solutions for the practical functioning of particular types of data cards;
—     how the message is processed further “downstream” of the interface between two systems;
—     the form which the data takes for use outside the data card, or the way in which such data is visibly represented on the data card or elsewhere.
NOTE            Not only does the definition of “medicinal products” differ from country to country, but also the same name can relate to entirely different products in some countries. Therefore, it is important to consider the safety of the patient when the card is used across borders.
This document describes and defines the Medication data objects used within or referenced by patient-held health data cards using UML, plain text and Abstract Syntax Notation (ASN.1).
This document does not describe nor define the common objects defined within ISO 21549-2.

  • Draft
    47 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO 18104:2023(Main)
Health informatics - Categorial structures for representation of nursing practice in terminological systems (ISO 18104:2023)
SIST EN ISO 18104:2024

This document specifies the characteristics of categorial structures, representing nursing practice. The overall aim of this document is to support interoperability in the exchange of meaningful information between information systems in respect of nursing diagnoses, nursing actions and nurse sensitive outcomes. Categorial structures for nursing diagnoses, nursing actions, nurse sensitive outcomes and associated categories support interoperability by providing common frameworks with which to
a)       analyse the features of different terminologies, including pre- and post-coordinated expressions, those of other healthcare disciplines, and to establish the nature of the relationship between them,[3][4][5][6][7][8]
b)       develop terminologies for representing nursing diagnoses, nursing actions,[9][10][11][12] and nurse sensitive outcomes,
c)        develop terminologies that are able to be related to each other,[3][8][13] and
d)       establish relationships between terminology models, information models, including archetypes, and ontologies in the nursing domain.[14][15][16][45]
There is early evidence that the categorial structures can be used as a framework for analysing nursing practice,[17] for developing nursing content of electronic record systems,[18][19] document the value of nursing services provided and to make nursing’s contribution visible[16][36][47][50].

  • Draft
    37 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO 21549-5:2023(Main)
Health informatics - Patient healthcard data - Part 5: Identification data (ISO 21549-5:2023)
SIST EN ISO 21549-5:2024

This document describes and defines the basic structure of the identification data objects held on healthcare data cards, but it does not specify particular data sets for storage on devices.
This document does not apply to the detailed functions and mechanisms of the following services (although its structures can accommodate suitable data objects elsewhere specified):
—    security functions and related services that are likely to be specified by users for data cards depending on their specific application, e.g. confidentiality protection, data integrity protection and authentication of persons and devices related to these functions;
—    access control services;
—    the initialization and issuing process (which begins the operating lifetime of an individual data card, and by which the data card is prepared for the data to be subsequently communicated to it according to this document).
Therefore, this document does not cover:
—    physical or logical solutions for the practical functioning of particular types of data card;
—    the forms that data take for use outside the data card, or the way in which such data are visibly represented on the data card or elsewhere.

  • Standard
    17 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEEE 11073-10419:2023(Main)
Health informatics - Personal health device communication - Part 10419: Device specialization - Insulin pump (ISO/IEEE 11073-10419:2019)
SIST EN ISO/IEEE 11073-10419:2023

This standard establishes a normative definition of communication between personal telehealth insulin pump devices (agents) and managers (e.g., cell phones, personal computers, personal health appliances, set top boxes) in a manner that enables plug-and-play interoperability. It leverages work done in other ISO/IEEE 11073 standards including existing terminology, information profiles, application profile standards, and transport standards. It specifies the use of specific term codes, formats, and behaviors in telehealth environments, restricting optionality in base frameworks in favor of interoperability. This standard defines a common core functionality of personal telehealth insulin pump devices.
In the context of personal health devices (PHDs), an insulin pump is a medical device used for the administration of insulin in the treatment of diabetes mellitus, also known as continuous subcutaneous insulin infusion (CSII) therapy.
This standard provides the data modeling according to ISO/IEEE 11073-20601 and does not specify the measurement method.

  • Standard
    135 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO 17117-1:2023(Main)
Health informatics - Terminological resources - Part 1: Characteristics (ISO 17117-1:2018)
SIST EN ISO 17117-1:2023

ISO 17117-1:2018 defines universal and specialized characteristics of health terminological resources that make them fit for the purposes required of various applications. It refers only to terminological resources that are primarily designed to be used for clinical concept representation or to those parts of other terminological resources designed to be used for clinical concept representation.
ISO 17117-1:2018 helps users to assess whether a terminology has the characteristics or provides the functions that will support their specified requirements. The focus of this document is to define characteristics and functions of terminological resources in healthcare that can be used to identify different types of them for categorization purposes. Clauses 4 and 5 support categorization according to the characteristics and functions of the terminological resources rather than the name.
NOTE       Categorization of healthcare terminological systems according to the name of the system might not be helpful and has caused confusion in the past.
The target groups for this document are:
a)    organizations wishing to select terminological systems for use in healthcare information systems;
b)    developers of terminological systems;
c)    developers of terminology standards;
d)    those undertaking independent evaluations/academic reviews of terminological resources;
e)    terminology Registration Authorities.
ISO 17117-1:2018 contains general characteristics and criteria with which systems can be evaluated.
The following considerations are outside the scope of this document.
-      Evaluations of terminological resources.
-      Health service requirements for terminological resources and evaluation criteria based on the characteristics and functions.
-      The nature and quality of mappings between different terminologies. It is unlikely that a single terminology will meet all the terminology requirements of a healthcare organization: some terminology providers produce mappings to administrative or statistical classifications such as the International Classification of Diseases (ICD). The presence of such maps would be a consideration in the evaluation of the terminology.
-      The nature and quality of mappings between different versions of the same terminology. To support data migration and historical retrieval, terminology providers can provide maps between versions of their terminology. The presence of such maps would be a consideration in the evaluation of the terminology.
-      Terminology server requirements and techniques and tools for terminology developers.
-      Characteristics for computational biology terminology. Progress in medical science and in terminology science will necessitate updating of this document in due course.

  • Standard
    38 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO 11239:2023(Main)
Health informatics - Identification of medicinal products - Data elements and structures for the unique identification and exchange of regulated information on pharmaceutical dose forms, units of presentation, routes of administration and packaging (ISO 11239:2023)
SIST EN ISO 11239:2023

This document specifies:
—     the data elements, structures and relationships between the data elements required for the exchange of information, which uniquely and with certainty identify pharmaceutical dose forms, units of presentation, routes of administration and packaging items (containers, closures and administration devices) related to medicinal products;
—     a mechanism for the association of translations of a single concept into different languages, which is an integral part of the information exchange;
—     a mechanism for the versioning of the concepts in order to track their evolution;
—     rules to help regional authorities to map existing regional terms to the terms created using this document, in a harmonized and meaningful way.

  • Standard
    37 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
CEN ISO/TS 20440:2023(Main)
Health informatics - Identification of medicinal products - Implementation guidelines for ISO 11239 data elements and structures for the unique identification and exchange of regulated information on pharmaceutical dose forms, units of presentation, routes of administration and packaging (ISO/TS 20440:2023)
SIST-TS CEN ISO/TS 20440:2023

This document describes data elements and structures for the unique identification and exchange of regulated information on pharmaceutical dose forms, units of presentation, routes of administration and packaging.
Based on the principles outlined in this document, harmonised controlled terminologies will be developed according to an agreed maintenance process, allowing users to consult the terminologies and locate the appropriate terms for the concepts that they wish to describe. Provisions to allow for the mapping of existing regional terminologies to the harmonised controlled terminologies will also be developed in order to facilitate the identification of the appropriate terms. The codes provided for the terms can then be used in the relevant fields in the PhPID, PCID and MPID in order to identify those concepts.
This document is intended for use by:
—    any organization that might be responsible for developing and maintaining such controlled vocabularies;
—    any regional authorities or software vendors who want to use the controlled vocabularies in their own systems and need to understand how they are created;
—    owners of databases who want to map their own terms to a standardized list of controlled vocabularies;
—    other users who want to understand the hierarchy of the controlled vocabularies in order to help identify the most appropriate term to describe a particular concept.
This document does not specify a particular terminology for the implementation of ISO 11239.

  • Technical specification
    53 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
CEN ISO/TS 17251:2023(Main)
Health informatics - Business requirements for a syntax to exchange structured dose information for medicinal products (ISO/TS 17251:2023)
SIST-TS CEN ISO/TS 17251:2023

This document specifies the business requirements for the structured content of structured or semi-
structured dose instructions for recording dose instructions in the electronic health record (EHR),
supporting clinical decision support, and in exchanging medication orders, as applicable to primary,
secondary and tertiary care.
This document is focused on the dose instructions as will be presented to the individual subject of care
or caregiver. Comprehension of dose instructions by the subject of care or caregiver is an overarching
consideration for subject of care safety and the best outcomes. Related factors are discussed but are not
part of the primary scope.
This document does not define an information model, except to the extent that those information model
concepts are necessary to define business requirements.
Outside the scope of this document are:
— The implementation of dose instructions, i.e. assembling the structured elements into a form
appropriate for the patient or caregiver;
— The content of a medication order (see ISO 17523) beyond content related to dose instructions;
— The content of a record of dispense of a medicinal product (see ISO/TS 19293);
— The functionality of health, clinical and/or pharmacy systems;
— Other kinds of content of health, clinical or pharmacy systems that are needed to support the whole
process of health care providers, such as:
— A drug knowledge database (see ISO/TS 22756);
— A decision support system (see ISO/TS 22756 and ISO/TS 22703);
— A complete medical record (EHR);
— A medicinal product dictionary (see ISO/TS 19256);
— Verification of the medicinal product and dose being administered.
— Some concepts from Identification of Medicinal Products are referenced, but not defined, in this
document. See Clause 4 for discussion of the relationship of this document with IDMP.

  • Technical specification
    23 pages
    English language
    sale 10% off
    e-Library read for
    1 day
CEN
EN ISO/IEEE 11073-10408:2022(Main)
Health informatics - Device interoperability - Part 10408: Personal health device communication - Device specialization - Thermometer (ISO/IEEE 11073-10408:2022)
SIST EN ISO/IEEE 11073-10408:2023

Within the context of the ISO/IEEE 11073 family of standards for device communication, this document establishes a normative definition of communication between personal telehealth thermometer devices and compute engines (e.g., cell phones, personal computers, personal health appliances, and set top boxes) in a manner that enables plug-and-play interoperability. It leverages appropriate portions of existing standards including ISO/IEEE 11073 terminology, information models, application profile standards, and transport standards. It specifies the use of specific term codes, formats, and behaviors in telehealth environments restricting optionality in base frameworks in favor of interoperability. This document defines a common core of communication functionality for personal telehealth thermometer devices.

  • Standard
    60 pages
    English language
    sale 10% off
    e-Library read for
    1 day