ISO 17090-2:2015

Overview

ISO 17090-2:2015 - Health informatics - Public key infrastructure - Part 2: Certificate profile - defines certificate profiles and technical requirements for using digital certificates in healthcare. It specifies how X.509-based certificates (per IETF/RFC 5280) should be structured to support secure exchange of healthcare information within organizations, across organizations and across jurisdictional boundaries. The standard focuses on healthcare-specific issues to enable interoperability, privacy, authentication and data integrity for electronic health records and other clinical systems.

Key topics and technical requirements

• Certificate types: profiles for CA certificates (root and subordinate), cross/bridge certificates and multiple end-entity certificates (individual identity, organization identity, device identity, application, AC and role certificates) are defined.
• Common certificate fields: mandatory and optional fields for issuer, subject, validity, subject public key information and signature are specified to ensure consistency.
• Certificate extensions: usage and format requirements for standard X.509 extensions such as authorityKeyIdentifier, subjectKeyIdentifier, keyUsage, privateKeyUsagePeriod, certificatePolicies, subjectAltName, basicConstraints, CRLDistributionPoints, ExtKeyUsage, Authority Information Access and Subject Information Access.
• Healthcare-specific attributes: support for subject directory attributes (including an hcRole attribute) and qualified certificate statements to represent healthcare roles and qualifications.
• Compliance and interoperability: alignment with X.509/RFC 5280 profiles and guidance to enable cross-domain and cross-jurisdiction trust frameworks.

Practical applications and who uses it

ISO 17090-2 is intended for organizations and professionals implementing PKI for healthcare:

• Healthcare IT architects and CISOs designing secure messaging, EHR access, telehealth and HIE (health information exchange).
• Certificate Authorities (CAs) and Registration Authorities (RAs) issuing healthcare certificates that must interoperate across vendors and borders.
• EMR/EHR vendors, medical device manufacturers and application developers embedding certificate validation, encryption and digital signatures.
• National health authorities and regulators establishing trusted identity frameworks and cross-border interoperability for patient data. Practical uses include secure clinical messaging, authentication of clinicians and devices, digitally signed clinical documents and encrypted exchange of patient records.

Related standards

• ISO 17090-1: Overview of digital certificate services (interoperability framework)
• ISO 17090-3: Policy management of certification authority
• ISO 17090-4: Digital signatures for healthcare documents
• IETF RFC 5280 and ITU-T X.509 (certificate and extension profiles)

ISO 17090-2 is a technical foundation for deploying healthcare PKI, helping organizations implement standardized, interoperable digital certificates for secure health information exchange.