HITSP Access Control Transaction Package

July 8, 2009

Version 1.4

HITSP Access Control Transaction Package

HITSP/TP20

Healthcare Information Technology Standards Panel (HITSP) logo

Submitted to:

Healthcare Information Technology Standards Panel

Submitted by:

Security, Privacy and Infrastructure Domain Technical Committee

(Formerly Security and Privacy Technical Committee)

Document Change History

Version Number	Description of Change	Name of Author	Date Published
1.0	Review Copy	Security and Privacy Technical Committee	July 20, 2007
1.0.1	Review Copy	Security and Privacy Technical Committee	October 5, 2007
1.1	Released for Implementation	Security and Privacy Technical Committee	October 15, 2007
	Template Updated to V2.4	Project Team	July 31, 2008
1.1.1	Review Copy	Security, Privacy, and Infrastructure Domain Technical Committee	August 20, 2008
1.2	Released for Implementation	Security, Privacy, and Infrastructure Domain Technical Committee	August 27, 2008
1.2.1	Review Copy	Security, Privacy, and Infrastructure Domain Technical Committee	December 10, 2008
1.3	Released for Implementation	Security, Privacy, and Infrastructure Domain Technical Committee	December 18, 2008
	Template V2.5	Project Team	June 30, 2009
1.3.1	Review Copy	Security, Privacy, and Infrastructure Domain Technical Committee	June 30, 2009
1.4	Released for Implementation	Security, Privacy, and Infrastructure Domain Technical Committee	July 8, 2009

Table of Contents

1.0 Introduction. 6

1.1 Overview. 6

1.2 Copyright Permissions. 6

1.3 Reference Documents. 6

1.4 Conformance. 6

1.4.1 Conformance Criteria. 6

1.4.2 Conformance Scoping, Subsetting and Options. 7

2.0 Transaction Package Definition. 8

2.1 Context Overview. 8

2.1.1 Transaction Package Constraints. 8

2.1.2 Interfaces. 9

2.1.3 Interface Interactions. 9

2.1.3.1 Security Assertion Markup Language (SAML) Overview. 12

2.1.3.1.1 SAML Healthcare Profile. 12

2.1.3.2 WS-Trust Overview. 12

2.1.3.2.1 WS-Trust Healthcare Profile. 13

2.1.3.3 XACML Overview. 13

2.1.3.3.1 Enforcing Privacy Consent Directive Policies. 13

2.1.3.3.2 XACML Healthcare Profile. 14

2.1.4 Pre-conditions. 14

2.1.4.1 Process Triggers. 14

2.1.5 Post-conditions. 15

2.1.5.1 Required Outputs. 15

2.2 List of HITSP Constructs. 15

2.2.1 Construct Dependencies. 16

2.2.2 Additional Constraints on Required Constructs. 16

2.3 Standards. 16

2.3.1 Regulatory Guidance. 16

2.3.2 Selected Standards. 16

2.3.3 Informative Reference Standards. 17

3.0 Appendix. 20

3.1 Access Control Implementation. 20

3.2 Examples of the Application of Access Control 21

3.2.1 Process Query to Provide Laboratory Test Result Location(s) 21

3.2.2 Provider Access to Patient Health Information is Verified in Accordance with the Consumer Consent 22

3.2.3 Patient Consent Directives (and Security Policies) are Enforced to Allow or Block Access to Patient Health Information. 22

3.3 Access Control and Authorization Services. 23

3.4 Structural and Functional Roles. 23

3.4.2 WS-Trust 25

3.4.3 XACML. 26

3.4.4 WS-Federation. 27

3.4.5 Other Standards. 27

4.0 Change History. 28

4.1 October 5, 2007. 28

4.2 October 15, 2007. 28

4.3 July 11, 2008. 28

4.4 August 20, 2008. 28

4.5 August 27, 2008. 28

4.6 DecemBer 10, 2008. 28

4.6.1 Section 1 Updates. 28

4.6.2 Section 2 Updates. 29

4.7 December 18, 2008. 29

4.8 June 30, 2009. 29

4.9 July 8, 2009. 29

Figures and Tables

Figure 2-1 High Level Access Control Interactions. 9

Figure 2-2 Detailed Access Control Interface Interaction Diagram.. 11

Figure 3-1 Development of Security and Privacy protections. 20

Figure 3-2 Full list of Permissions from HL7. 23

Figure 3-3 Role Structure (Adapted from ANSI INCITS Role Model) 24

Figure 3-4 Access Control Standards. 25

Figure 3-5 WS-Trust Security Model 26

Figure 3-6 OASIS XACML Components. 26

Table 1-1 Reference Documents. 6

Table 2-1 Transaction Package Constraints. 8

Table 2-2 Interfaces. 9

Table 2-3 Interface and Transaction/Content Constraints. 9

Table 2-4 Pre-conditions. 14

Table 2-5 Process Triggers. 14

Table 2-6 Post-conditions. 15

Table 2-7 Required Outputs. 15

Table 2-8 List of Constructs. 15

Table 2-9 Construct Dependencies. 16

Table 2-10 Additional Constraints on Required Constructs. 16

Table 2-11 Regulatory Guidance. 16

Table 2-12 Selected Standards. 16

Table 2-13 Informative Reference Standards. 17

Table 3-1 Full list of Permissions from HL7. 22