This document gives guidelines for certificate management issues involved in deploying digital certificates in healthcare. It specifies a structure and minimum requirements for certificate policies, as well as a structure for associated certification practice statements.<\/p>\n
This document also identifies the principles needed in a healthcare security policy for cross-border communication and defines the minimum levels of security required, concentrating on aspects unique to healthcare.<\/p>\n
| PDF Pages<\/th>\n | PDF Title<\/th>\n<\/tr>\n | ||||||
|---|---|---|---|---|---|---|---|
| 2<\/td>\n | National foreword <\/td>\n<\/tr>\n | ||||||
| 7<\/td>\n | Foreword <\/td>\n<\/tr>\n | ||||||
| 8<\/td>\n | Introduction <\/td>\n<\/tr>\n | ||||||
| 11<\/td>\n | 1 Scope 2 Normative references 3 Terms and definitions 4 Abbreviations <\/td>\n<\/tr>\n | ||||||
| 12<\/td>\n | 5 Requirements for digital certificate policy management in a healthcare context 5.1 General 5.2 Need for a high level of assurance 5.3 Need for a high level of infrastructure availability 5.4 Need for a high level of trust <\/td>\n<\/tr>\n | ||||||
| 13<\/td>\n | 5.5 Need for Internet compatibility 5.6 Need to facilitate evaluation and comparison of CPs 6 Structure of healthcare CPs and healthcare CPSs 6.1 General requirements for CPs <\/td>\n<\/tr>\n | ||||||
| 14<\/td>\n | 6.2 General requirements for CPSs 6.3 Relationship between a CP and a CPS 6.4 Applicability <\/td>\n<\/tr>\n | ||||||
| 15<\/td>\n | 7 Minimum requirements for a healthcare CP 7.1 General requirements 7.2 Publication and repository responsibilities 7.2.1 Repositories 7.2.2 Publication of certification information 7.2.3 Frequency of publication 7.2.4 Access controls on repositories <\/td>\n<\/tr>\n | ||||||
| 16<\/td>\n | 7.3 Identification and authentication 7.3.1 Initial registration <\/td>\n<\/tr>\n | ||||||
| 17<\/td>\n | 7.3.2 Initial identity validation <\/td>\n<\/tr>\n | ||||||
| 18<\/td>\n | 7.3.3 Identification and authentication for re-keying requests 7.3.4 Identification and authentication for revocation request <\/td>\n<\/tr>\n | ||||||
| 19<\/td>\n | 7.4 Certificate life-cycle operational requirements 7.4.1 Certificate application <\/td>\n<\/tr>\n | ||||||
| 20<\/td>\n | 7.4.2 Certificate application processing 7.4.3 Certificate issuance <\/td>\n<\/tr>\n | ||||||
| 21<\/td>\n | 7.4.4 Certificate acceptance 7.4.5 Key pair and certificate usage <\/td>\n<\/tr>\n | ||||||
| 22<\/td>\n | 7.4.6 Certificate renewal <\/td>\n<\/tr>\n | ||||||
| 23<\/td>\n | 7.4.7 Certificate re-key 7.4.8 Certificate modification <\/td>\n<\/tr>\n | ||||||
| 24<\/td>\n | 7.4.9 Certificate revocation and suspension <\/td>\n<\/tr>\n | ||||||
| 27<\/td>\n | 7.4.10 Certificate status services <\/td>\n<\/tr>\n | ||||||
| 28<\/td>\n | 7.4.11 End of subscription 7.4.12 Private key escrow 7.5 Physical controls 7.5.1 General 7.5.2 Physical controls 7.5.3 Procedural controls 7.5.4 Personnel controls 7.5.5 Security audit logging procedures 7.5.6 Record archive <\/td>\n<\/tr>\n | ||||||
| 29<\/td>\n | 7.5.7 Key changeover 7.5.8 Compromise and disaster recovery 7.5.9 CA termination 7.6 Technical security controls 7.6.1 Key pair generation and installation <\/td>\n<\/tr>\n | ||||||
| 31<\/td>\n | 7.6.2 Private key protection <\/td>\n<\/tr>\n | ||||||
| 32<\/td>\n | 7.6.3 Other aspects of key management <\/td>\n<\/tr>\n | ||||||
| 33<\/td>\n | 7.6.4 Activation data 7.6.5 Computer security controls 7.6.6 Life-cycle technical controls 7.6.7 Network security controls <\/td>\n<\/tr>\n | ||||||
| 34<\/td>\n | 7.6.8 Time stamping 7.7 Certificate, CRL and OCSP profiles 7.8 Compliance audit 7.8.1 General 7.8.2 Frequency of CA compliance audit 7.8.3 Identity\/qualifications of auditor 7.8.4 Auditor’s relationship to audited party 7.8.5 Topics covered by audit <\/td>\n<\/tr>\n | ||||||
| 35<\/td>\n | 7.8.6 Actions taken as a result of deficiency <\/td>\n<\/tr>\n | ||||||
| 36<\/td>\n | 7.8.7 Communication of audit results 7.9 Other business and legal matters 7.9.1 Fees 7.9.2 Financial responsibility 7.9.3 Confidentiality of business information 7.9.4 Privacy of personal information <\/td>\n<\/tr>\n | ||||||
| 37<\/td>\n | 7.9.5 Intellectual property rights 7.9.6 Representations and warranties <\/td>\n<\/tr>\n | ||||||
| 39<\/td>\n | 7.9.7 Disclaimers of warranties 7.9.8 Limitations of liability <\/td>\n<\/tr>\n | ||||||
| 40<\/td>\n | 7.9.9 Indemnities 7.9.10 Term and termination 7.9.11 Individual notices and communication with participants 7.9.12 Amendments 7.9.13 Dispute resolution procedures <\/td>\n<\/tr>\n | ||||||
| 41<\/td>\n | 7.9.14 Governing law 7.9.15 Compliance with applicable law 7.9.16 Miscellaneous provisions 8 Model PKI disclosure statement 8.1 Introduction <\/td>\n<\/tr>\n | ||||||
| 42<\/td>\n | 8.2 Structure of PKI disclosure statement <\/td>\n<\/tr>\n | ||||||
| 43<\/td>\n | Bibliography <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":" Health informatics. Public key infrastructure – Policy management of certification authority<\/b><\/p>\n |