TECHNICAL ISO/TR REPORT 11636 First edition 2009-12-01 Health Informatics Dynamic on-demand virtual private network for health information infrastructure Informatique de santeReseau prive, virtuel, dymanique, sur demande pour infrastructure d'information de sante Reference number ISO/TR 11636:2009(E) @ISO2009 ISO/TR 11636:2009(E) PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by IsO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below COPYRIGHTPROTECTEDDOCUMENT ISO2009 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, isO's memberbody in the country of the requester. ISO copyright office Case postale 56 . CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail [email protected] Web www.iso.org Published in Switzerland ii @ Iso 2009 - All rights reserved ISO/TR 11636:2009(E) Contents Page Foreword Introduction 1 Scope 2 Terms and definitions 3 Abbreviated terms 4 Network features in the healthcare field .... 4.1 Pattern of current or expected information services in the healthcare field 4.2 Category of healthcare information to be protected (information assets), 4.3 Network requirementsinthe healthcarefield... 5 Concept of network construction in the healthcare field. .6 5.1 Overview.. 5.2 Responsibility to manage security of healthcare information exchange including personal information between independent institutions ..... 5.3 Securityconceptsinnetworksystemsformedicalinstitutions 6 Threat analysis and measures . < Network construction in the healthcare field 7.1 Minimum guidelines for security management of healthcare information exchange including personal information between external institutions.... 10 7.2 Technicalandoperationalchecklistsforevaluationofnetworksecurity... 7.3 Application of an on-demand VPN .. 11 8 Cases of security measures in a dynamic on-demand vPN for exchange of healthcare information with external institutions ... 8.1 Introduction.. 12 8.2 Regionalhealthcarecooperationmodelwithahealthcareportal. 12 8.3 Onlinemaintenancemodel.. .13 8.4 Regional cooperation model with the lead taken by a regional core hospital. 8.5 Model for teleradiology, remote maintenance and network conferencing with the 8.6 University hospital model centred around teleradiology, telepathology and network conferencesconductedbetweena universityhospital andregionalhospitals.. 16 Annex A (informative) Threat analysis and measures , .18 Annex B (informative) Security management of medical information exchange including personal data between independent institutions (see reference [6]) .. .25 Annex C (informative) Technical and operational checklists for the guideline.. Annex D (informative) Technology used: Dynamic on-demand VPN 62 Bibliography.... Iso 2009- All rights reserved ii ISO/TR 11636:2009(E) Foreword Iso (the International Organization for Standardization) is a worldwide federation of national standards bodies (isO member bodies). The work of preparing International Standards is normally carried out through IsO technicalcommittees.Eachmemberbodyinterestedinasubjectforwhichatechnicalcommitteehasbeen non-governmental,in liaison withlsO,also takepart inthe work.Isocollaborates closelywith the InternationalElectrotechnicalCommission(lEC)onallmattersofelectrotechnicalstandardization. Inter