organization background

PKI in Healthcare PKI in Healthcare

Dave Barnett Dave Barnett Systems ArchitectSystems ArchitectKaiser PermanenteKaiser Permanente

[email protected]@kp.org(925) 926-3520(925) 926-3520

March 6, 2000 March 6, 2000 © Kaiser Permanente Medical Care Program© Kaiser Permanente Medical Care Program 22

Organization BackgroundOrganization Background

Kaiser Permanente Medical Kaiser Permanente Medical Care ProgramCare Program First HMO (founded in 1945)First HMO (founded in 1945) Now in 11 states and District of Now in 11 states and District of

ColumbiaColumbia 8 Million Members8 Million Members 11,000 Physicians11,000 Physicians 90,000 Employees90,000 Employees 30 Medical Centers30 Medical Centers 360 Medical Facilities360 Medical Facilities


PKI Project Business DriversPKI Project Business Drivers

Move duplicated functions Move duplicated functions (e.g. security) from (e.g. security) from applications to infrastructureapplications to infrastructure

Electronic Healthcare Records Electronic Healthcare Records and Services replacing paper and Services replacing paper based based

Regulatory complianceRegulatory compliance Health Insurance Portability and Health Insurance Portability and

Accountability Act (HIPAA) Accountability Act (HIPAA) http://aspe.os.dhhs.gov/http://aspe.os.dhhs.gov/

admnsimp/admnsimp/


PKI Project Business DriversPKI Project Business Drivers

Healthcare Community of Healthcare Community of InterestInterest California Medical Association California Medical Association

estimates that each California estimates that each California Physician does business with 50 Physician does business with 50 to 100 healthcare organizationsto 100 healthcare organizations

Considerable opportunity for e-Considerable opportunity for e-businessbusiness Commerce (supplies, Commerce (supplies,

pharmaceuticals, etc.)pharmaceuticals, etc.) Patient servicesPatient services

Benefits (e.g., with Employer)Benefits (e.g., with Employer) Referrals for Medical ServicesReferrals for Medical Services Emergency RoomEmergency Room


KP PKI Project ScopeKP PKI Project Scope

KP PKI-enabled CIS (Clinical KP PKI-enabled CIS (Clinical Information System)Information System) First 2,500 users in September First 2,500 users in September

20002000 Roll-out to 70,000 usersRoll-out to 70,000 users

VPN/ExtranetVPN/Extranet Applications with AffiliatesApplications with Affiliates EDI and e-businessEDI and e-business


KP PKI Project ScopeKP PKI Project Scope

Secure E-mail (S/MIME)Secure E-mail (S/MIME) Partner / AffiliatePartner / Affiliate Patient - DoctorPatient - Doctor

Web Web Patient access to medical Patient access to medical

information and servicesinformation and services Partner and Affiliate access to Partner and Affiliate access to

resourcesresources Interoperability demo with Interoperability demo with

California Medical Association California Medical Association and Tunitas Group Healthcare and Tunitas Group Healthcare PKIPKI


Healthcare PKI Demo ProjectHealthcare PKI Demo Project California Medical AssociationCalifornia Medical Association

CA for California PhysiciansCA for California Physicians See http://www.cmanet.org/ for See http://www.cmanet.org/ for

information on MEDePass programinformation on MEDePass program CMA Bridge CACMA Bridge CA Will interoperate with KP Bridge Will interoperate with KP Bridge

CACA PKI Interoperability Demo PKI Interoperability Demo

WorkshopWorkshop Kaiser Permanente, CMA, Blue Kaiser Permanente, CMA, Blue

Shield of California, Scripps, Hill Shield of California, Scripps, Hill Physicians, Social Security Physicians, Social Security Admin, Pacificare, Catholic Admin, Pacificare, Catholic Healthcare West, Sutter, St. Healthcare West, Sutter, St. Joseph, etc.Joseph, etc. http://www.tunitas.com/pages/PKI/http://www.tunitas.com/pages/PKI/

pki.htmpki.htm


Interoperability IssuesInteroperability Issues

Healthcare Certificate Policies Healthcare Certificate Policies and Certification Practice and Certification Practice Statements Statements

Assurance of IdentityAssurance of Identity Certificate ProfilesCertificate Profiles Privilege Management Privilege Management

(Future)(Future)


CP and CPSCP and CPS Existing CP / CPS examples Existing CP / CPS examples

not usefulnot useful Policy and legal requirements of

an organization that sells certificates and CA services different from Healthcare provider requirements

Healthcare Model Policy Creation and Support is Critical ANSI HISB Meeting March 1 - 2

2000(http://www.ansi.org/rooms/room_41/(http://www.ansi.org/rooms/room_41/

default.htm)default.htm) ASTM E31.20 Healthcare Model ASTM E31.20 Healthcare Model

Policy only work in progress under Policy only work in progress under ANSIANSI See E31 Committee at See E31 Committee at

http://www.astm.org http://www.astm.org See draft Healthcare Model Policy at See draft Healthcare Model Policy at

http://www.tunitas.com/pages/PKI/docs/http://www.tunitas.com/pages/PKI/docs/


Assurance of IdentityAssurance of Identity

Assurance of Identity is one of Assurance of Identity is one of the considerations for the considerations for Assurance Level in CPAssurance Level in CP

Healthcare Provider Healthcare Provider Certificate is a high value Certificate is a high value targettarget Allows impersonation of Allows impersonation of

physician electronicallyphysician electronically Identity assurance and Identity assurance and

authentication must be authentication must be acceptable to industry and acceptable to industry and regulatorsregulators

e.g., what would the DEA require for a e.g., what would the DEA require for a digital signature for electronic digital signature for electronic prescriptions?prescriptions?


Profile ProliferationProfile Proliferation Tendency for each Tendency for each

organization, vendor, organization, vendor, application, and community of application, and community of interest to create a certificate interest to create a certificate profileprofile

Need to converge on smallest Need to converge on smallest number of profiles required number of profiles required (e.g., vertical industry (e.g., vertical industry community of interest)community of interest)

Need to develop an X.509 v3 Need to develop an X.509 v3 profile for Healthcare based on profile for Healthcare based on RFC 2459 and ASTM E31.20RFC 2459 and ASTM E31.20


Privilege ManagementPrivilege Management Access control and Access control and

authorization can become very authorization can become very complex in Healthcarecomplex in Healthcare

RolesRoles Appointment Clerk, Billing, Physician, Appointment Clerk, Billing, Physician,

Radiologist, Lab, Psychiatric Social Radiologist, Lab, Psychiatric Social Worker, etc. Worker, etc.

ContentContent HIV, Substance Abuse, Mental Health HIV, Substance Abuse, Mental Health

National and State RegulationsNational and State Regulations Policy (organizational and Policy (organizational and

departmental)departmental) Context (Emergency Dept.)Context (Emergency Dept.) Privilege changes may be frequentPrivilege changes may be frequent Multiple roles not uncommonMultiple roles not uncommon


Privilege ManagementPrivilege Management ITU and IETF proposing ITU and IETF proposing

Attribute Certificates (X.509) Attribute Certificates (X.509) for PMI for PMI

Open Group just approved Open Group just approved Authorization API (aznAPI) as Authorization API (aznAPI) as a standard for authorizationa standard for authorization

Not mutually exclusiveNot mutually exclusive aznAPI can use Attribute aznAPI can use Attribute

Certificates as well as other Certificates as well as other approaches (e.g., rule or role approaches (e.g., rule or role based “authorization engine”)based “authorization engine”)


Privilege ManagementPrivilege Management Standards not stabilized yet, Standards not stabilized yet,

products are very newproducts are very new PMI can be very useful in PMI can be very useful in

HealthcareHealthcare Healthcare industry interest Healthcare industry interest

likely to grow in this arealikely to grow in this area


Thank you!Thank you!

organization background

Documents

medical information

draft healthcare model

catholic healthcare

california physicianssee

assurance level

assurance of identityassurance

accountability act hipaa

resourcesinteroperability