EN ISO 27789:2013
(Main)Health informatics - Audit trails for electronic health records (ISO 27789:2013)
Health informatics - Audit trails for electronic health records (ISO 27789:2013)
ISO 27789:2013 specifies a common framework for audit trails for electronic health records (EHR), in terms of audit trigger events and audit data, to keep the complete set of personal health information auditable across information systems and domains.
It is applicable to systems processing personal health information which, complying with ISO 27799, create a secure audit record each time a user accesses, creates, updates or archives personal health information via the system.
ISO 27789:2013 covers only actions performed on the EHR, which are governed by the access policy for the domain where the electronic health record resides. It does not deal with any personal health information from the electronic health record, other than identifiers, the audit record only containing links to EHR segments as defined by the governing access policy.
It does not cover the specification and use of audit logs for system management and system security purposes, such as the detection of performance problems, application flaw, or support for a reconstruction of data, which are dealt with by general computer security standards such as ISO/IEC 15408-2.
Medizinische Informatik - Audit-Trails für elektronische Gesundheitsakten (ISO 27789:2013)
Diese Internationale Norm legt einen gemeinsamen Rahmen für Audit-Trails für elektronische Gesundheitsakten (eGA), für die auslösenden Ereignisse eines Audits und für Auditdaten fest, um die Auditierbarkeit des vollständigen Satzes der persönlichen Gesundheitsinformationen über Informations-systeme und Zuständigkeitsbereiche hinweg aufrechtzuerhalten.
Sie ist anwendbar für Systeme die persönliche Gesundheitsinformationen verarbeiten, entsprechend ISO 27799, und jedes Mal, wenn ein Benutzer über das System auf diese Informationen zugreift, sie erzeugt, aktualisiert oder archiviert, einen sicheren Auditeintrag erstellen.
ANMERKUNG Bei diesem Auditeintrag handelt es sich mindestens um eine eindeutige Identifizierung des Benutzers, eine eindeutige Identifizierung des Behandelten, eine Angabe der vom Benutzer ausgeführten Funktion (Erzeugung, Zugriff auf, Aktualisierung eines Eintrags usw.) und die Aufzeichnung des Datums und der Uhrzeit, zu dem die Funktion ausgeführt wurde.
Diese Internationale Norm beschränkt sich auf an elektronischen Gesundheitsakten ausgeführte Aktionen, welche durch die Zugriffsleitlinien für die Domäne bestimmt werden, in der die elektronische Gesundheitsakte liegt. Sie enthalten abgesehen von Bezeichnern keinerlei persönliche Gesundheitsinformationen aus der elektronischen Gesundheitsakte. Der Auditeintrag enthält lediglich entsprechend den jeweiligen Zugriffsleitlinien definierte Verknüpfungen zu eGA-Segmenten.
Die Spezifikation und Anwendung von Auditprotokollen für die Systemverwaltung und Systemsicherheit, zum Beispiel zur Erkennung von Leistungsproblemen und Anwendungsfehlern oder zur Unterstützung einer Datenrekonstruktion, liegen außerhalb des Anwendungsbereichs dieses Dokuments. Diese Aspekte sind bereits in allgemeinen Normen zur IT-Sicherheit, zum Beispiel in ISO/IEC 15408-2 [9], behandelt.
Anhang A enthält Beispiele für verschiedene Auditszenarien. Anhang B gibt einen Überblick über Dienste für eine Auditprotokollverwaltung.
Informatique de santé - Historique d'expertise des dossiers de santé informatisés (ISO 27789:2013)
L'ISO 27789:2013 spécifie une structure commune pour les historiques d'expertise des dossiers informatisés de santé (DIS), en termes d'événements déclencheurs d'expertise et de données d'expertise, afin de conserver l'ensemble des informations personnelles de santé pouvant être expertisées sur tous les systèmes et domaines d'information.
Elle s'applique aux systèmes de traitement des informations personnelles de santé qui, conformément à l'ISO 27799, créent un enregistrement d'expertise sûr chaque fois qu'un utilisateur crée des informations personnelles de santé, qu'il y accède, qu'il les met à jour ou qu'il les archive par le biais du système.
L'ISO 27789:2013 ne couvre que les actions effectuées sur le dossier informatisé de santé, qui sont régies par une politique d'accès propre au domaine dans lequel s'inscrit le dossier informatisé de santé. Elle ne traite pas des informations personnelles de santé issues de dossier informatisé de santé mais uniquement des identifiants, l'enregistrement d'expertise ne contenant que les liens menant aux segments du dossier informatisé de santé, tel qu'établi par la politique d'accès en vigueur.
Elle ne couvre pas non plus la spécification et l'utilisation des rapports d'expertise dans un but de gestion et de sécurité du système, par exemple pour la détection des problèmes de performance, des failles au niveau des applications, ou en tant que support pour la reconstruction des données, qui sont traitées par les normes de sécurité informatique générales telles que l'ISO/CEI 15408.
Zdravstvena informatika - Revizijske sledi za elektronske zdravstvene zapise (ISO 27789:2013)
Ta mednarodni standard določa splošen okvir za revizijske sledi za elektronske zapise v zdravstvenem varstvu (EHR) v zvezi z dogodki, ki sprožijo revizijo, in revizijskimi podatki, da se ohrani možnost revizije celotnega sklopa osebnih zdravstvenih podatkov v informacijskih sistemih in domenah. Uporablja se za sisteme, ki obdelujejo osebne zdravstvene podatke in v skladu s standardom ISO 27799 ustvarijo varen revizijski zapis vsakič, ko uporabnik dostopi do, ustvari, posodobi ali arhivira osebne zdravstvene podatke prek sistema. Ta mednarodni standard obravnava le ukrepe v zvezi z elektronskimi zapisi v zdravstvenem varstvu, ki jih ureja pravilnik dostopa za domeno, v kateri se nahaja elektronski zapis v zdravstvenem varstvu. Standard razen identifikatorjev ne obravnava osebnih zdravstvenih podatkov iz elektronskega zapisa v zdravstvenem varstvu, pri čemer revizijski zapis vsebuje le povezave do segmentov elektronskih zapisov v zdravstvenem varstvu, kot je opredeljeno v veljavnem pravilniku dostopa. Standard ne obravnava specifikacije in uporabe revizijskih dnevnikov za namene vodenja in varnosti sistema, kot je zaznavanje težav z delovanjem, napaka pri uporabi ali podpora za obnovo podatkov, ki so obravnavani v standardih s področja splošne računalniške varnosti, kot je ISO/IEC 15408. V dodatku A so navedeni primeri revizijskih scenarijev. Dodatek B zajema pregled storitev revizijskih dnevnikov.
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
SIST EN ISO 27789:2013
01-maj-2013
Zdravstvena informatika - Revizijske sledi za elektronske zapise v zdravstvenem
varstvu (ISO 27789:2013)
Health informatics - Audit trails for electronic health records (ISO 27789:2013)
Medizinische Informatik - Audit Trails für elektronische Gesundheitsakten (ISO
27789:2013)
Informatique de santé - Historique d'expertise des dossiers de santé informatisés (ISO
27789:2013)
Ta slovenski standard je istoveten z: EN ISO 27789:2013
ICS:
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
SIST EN ISO 27789:2013 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST EN ISO 27789:2013
---------------------- Page: 2 ----------------------
SIST EN ISO 27789:2013
EUROPEAN STANDARD
EN ISO 27789
NORME EUROPÉENNE
EUROPÄISCHE NORM
March 2013
ICS 35.240.80
English Version
Health informatics - Audit trails for electronic health records (ISO
27789:2013)
Informatique de santé - Historique d'expertise des dossiers Medizinische Informatik - Audit-Trails für elektronische
de santé informatisés (ISO 27789:2013) Gesundheitsakten (ISO 27789:2013)
This European Standard was approved by CEN on 16 February 2013.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same
status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United
Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2013 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 27789:2013: E
worldwide for CEN national Members.
---------------------- Page: 3 ----------------------
SIST EN ISO 27789:2013
EN ISO 27789:2013 (E)
Contents Page
Foreword . 3
2
---------------------- Page: 4 ----------------------
SIST EN ISO 27789:2013
EN ISO 27789:2013 (E)
Foreword
This document (EN ISO 27789:2013) has been prepared by Technical Committee ISO/TC 215 "Health
informatics" in collaboration with Technical Committee CEN/TC 251 “Health informatics” the secretariat of
which is held by NEN.
This European Standard shall be given the status of a national standard, either by publication of an identical
text or by endorsement, at the latest by September 2013, and conflicting national standards shall be
withdrawn at the latest by September 2013.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the following
countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech
Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece,
Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom.
Endorsement notice
The text of ISO 27789:2013 has been approved by CEN as EN ISO 27789:2013 without any modification.
3
---------------------- Page: 5 ----------------------
SIST EN ISO 27789:2013
---------------------- Page: 6 ----------------------
SIST EN ISO 27789:2013
INTERNATIONAL ISO
STANDARD 27789
First edition
2013-03-01
Health informatics — Audit trails for
electronic health records
Informatique de santé — Historique d’expertise des dossiers de
santé informatisés
Reference number
ISO 27789:2013(E)
©
ISO 2013
---------------------- Page: 7 ----------------------
SIST EN ISO 2
...
SLOVENSKI STANDARD
SIST EN ISO 27789:2013
01-maj-2013
Zdravstvena informatika - Revizijske sledi za elektronske zdravstvene zapise (ISO
27789:2013)
Health informatics - Audit trails for electronic health records (ISO 27789:2013)
Medizinische Informatik - Audit Trails für elektronische Gesundheitsakten (ISO
27789:2013)
Informatique de santé - Historique d'expertise des dossiers de santé informatisés (ISO
27789:2013)
Ta slovenski standard je istoveten z: EN ISO 27789:2013
ICS:
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
SIST EN ISO 27789:2013 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST EN ISO 27789:2013
---------------------- Page: 2 ----------------------
SIST EN ISO 27789:2013
EUROPEAN STANDARD
EN ISO 27789
NORME EUROPÉENNE
EUROPÄISCHE NORM
March 2013
ICS 35.240.80
English Version
Health informatics - Audit trails for electronic health records (ISO
27789:2013)
Informatique de santé - Historique d'expertise des dossiers Medizinische Informatik - Audit-Trails für elektronische
de santé informatisés (ISO 27789:2013) Gesundheitsakten (ISO 27789:2013)
This European Standard was approved by CEN on 16 February 2013.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same
status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United
Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2013 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 27789:2013: E
worldwide for CEN national Members.
---------------------- Page: 3 ----------------------
SIST EN ISO 27789:2013
EN ISO 27789:2013 (E)
Contents Page
Foreword . 3
2
---------------------- Page: 4 ----------------------
SIST EN ISO 27789:2013
EN ISO 27789:2013 (E)
Foreword
This document (EN ISO 27789:2013) has been prepared by Technical Committee ISO/TC 215 "Health
informatics" in collaboration with Technical Committee CEN/TC 251 “Health informatics” the secretariat of
which is held by NEN.
This European Standard shall be given the status of a national standard, either by publication of an identical
text or by endorsement, at the latest by September 2013, and conflicting national standards shall be
withdrawn at the latest by September 2013.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the following
countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech
Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece,
Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom.
Endorsement notice
The text of ISO 27789:2013 has been approved by CEN as EN ISO 27789:2013 without any modification.
3
---------------------- Page: 5 ----------------------
SIST EN ISO 27789:2013
---------------------- Page: 6 ----------------------
SIST EN ISO 27789:2013
INTERNATIONAL ISO
STANDARD 27789
First edition
2013-03-01
Health informatics — Audit trails for
electronic health records
Informatique de santé — Historique d’expertise des dossiers de
santé informatisés
Reference number
ISO 27789:2013(E)
©
ISO 2013
---------------------- Page: 7 ----------------------
SIST EN ISO 27789:2013
ISO 27789:2013
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.