ISO/TS 23535:2022
(Main)Health informatics — Requirements for customer-oriented health cloud service agreements
Health informatics — Requirements for customer-oriented health cloud service agreements
This document describes a core set of cloud service agreements for customer-oriented health cloud services. This document covers a customer-oriented cloud service agreement that can be used in healthcare organizations and public health centers that use health cloud services. This document defines key characteristics in the health cloud service agreement that are indispensable in providing optimal health/healthcare management functionalities. Privacy and security features are considered outside the scope of this document and are covered in ISO/TR 21332. The purpose of this document is to present matters to be considered (e.g., cloud type, components, key characteristics) by stakeholders involved in the implementation of cloud computing in hospitals or healthcare organizations. The potential users of this document are mainly 1) IT managers of hospitals, 2) hospital management, and 3) cloud service providers and cloud partners that provide services to healthcare institutions.
Titre manque
General Information
Standards Content (Sample)
TECHNICAL ISO/TS
SPECIFICATION 23535
First edition
2022-01
Health informatics — Requirements
for customer-oriented health cloud
service agreements
Reference number
© ISO 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Cloud computing in health and healthcare . 4
4.1 Cloud computing in hospital . 4
4.2 Gap between CSC’s expectation and CSP’s solution . 4
5 CSA for health and healthcare . 5
5.1 Roles and responsibilities . 5
5.1.1 Cloud service customer . 5
5.1.2 Cloud service provider . 7
5.2 Service support .12
5.2.1 Service catalogue .12
5.2.2 Service coverage . 13
5.2.3 Uninterrupted service . 13
5.2.4 Accountability for service interruption . 13
5.2.5 Compensation for service interruption . 13
5.2.6 Service downtime . 13
5.2.7 Service disruption notification . 13
5.2.8 Target response time . 14
5.2.9 Information on subcontractors . 14
5.3 Service model. 14
5.4 Service monitoring . 14
5.5 Incident reporting. 15
5.5.1 Incident report . 15
5.5.2 Incident response . 15
5.5.3 Incident report delivery . 15
5.5.4 Repair time .15
5.6 Standards, testing, and certification . 15
5.6.1 Conformity with international standards . 15
5.6.2 Guidelines for ensuring compatibility between clouds . 15
5.6.3 Support data input . 16
5.6.4 Adopt international standards . 16
5.6.5 Compliance with non-international standards . 16
5.6.6 Compliance test . 16
5.6.7 Compliance with updated standards . 16
5.6.8 Certification details . 16
5.7 Data location . 16
5.7.1 Cloud service area and location . 16
5.7.2 Cloud relocation . 16
5.7.3 Violation of advance notice . 16
5.8 Data governance . 16
5.8.1 Cloud data maintenance policy . 16
5.8.2 Cloud data backup plan . 17
5.8.3 Cloud data collection . 17
5.8.4 Cloud data query history . 17
5.9 Data security . 17
5.9.1 Technical security measures . 17
5.9.2 Administrative security measures . 17
5.9.3 Physical security measures . 18
5.9.4 Simulation for technical security measures . 18
iii
5.9.5 Data integrity assurance . 18
5.9.6 De-identification . 18
5.10 Data transfer . 18
5.10.1 Data transfer deadline. 18
5.10.2 Data transfer method . 18
5.10.3 Data transfer roles . 18
5.10.4 Data deletion method . 18
5.10.5 Data transfer customer approval . 18
5.10.6 Approved data transfer range . 18
5.10.7 Responsibilities for data transfer violation . 19
5.11 Billing system and operation policies . 19
5.11.1 Billing system criteria . 19
5.11.2 Internal cloud operational policy . 19
5.11.3 Billing for excess usage . 19
5.12 Payments . 19
5.12.1 Payment method/time . 19
5.12.2 Payment period . 19
5.12.3 Payment method. 19
5.12.4 Explanation of billing details . 19
5.13 Regulatory compliance . 19
5.13.1 Jurisdiction compliance . 19
5.14 Service update and version management . 20
5.14.1 Service update notification . 20
5.14.2 Change notification upon service update . 20
5.14.3 Service update stability assessment . . 20
5.14.4 Service version management .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.