Patient Data Security; Node Authentication, Certificates And Certification Authority - AGFA Drystar AXYS User Manual

Patient Data Security

It is the responsibility of the hospital to ensure that the patients' legal require-
ments are met and that the security of the patient records is:
maintained and tested,
audited,
administered locally to cover risks from third party access and
how the availability of the services is to be maintained in the event of disaster.
It is the responsibility of the hospital to ensure that types of access are identi-
fied, classified and reasons for access are justified.
Node authentication, certificates and Certification
Authority
Each device - connected to a network - will receive a unique identifier: the
X.509 certificate, a digital passport. Any device on the network is only allowed
to communicate with another node of which it is holding the certificate in a
'communication allowed' table.
A Certification Authority (CA) is responsible for creating a certificate. The CA
can be the hospital, Agfa or a third party.
This CA distributes the certificate to the hospital security responsible or service
technician, who for his part:
Imports the device certificate, created by the CA.
Imports the certificates of all peer devices with which communication is autho-
rized, i.e. creates the list of 'communication allowed' device certificates.
2852 A EN 20070205
D AXYS
RYSTAR
39