ISO 17090-3:2021

Overview

ISO 17090-3:2021 - Health informatics - Public key infrastructure - Part 3: Policy management of certification authority - provides guidelines for certificate management when deploying digital certificates in healthcare. It specifies a structure and minimum requirements for certificate policies (CPs) and a structure for associated certification practice statements (CPSs). The standard identifies principles for healthcare security policies that support cross‑border communication and defines minimum security levels focused on aspects unique to healthcare PKI deployments.

Key Topics and Requirements

The standard organizes policy management requirements around practical PKI operations commonly needed in healthcare:

• Governance and assurance
  • Need for a high level of assurance, availability and trust for healthcare PKI.
  • Internet compatibility and facilitation of CP evaluation and comparison.
• Structure of policy documents
  • Required structure and content for CPs and CPSs and their relationship.
• Publication and repositories
  • Rules for repositories, publication frequency and access controls for certificate information.
• Identification and authentication
  • Procedures for initial registration, identity validation, re‑keying and revocation requests.
• Certificate lifecycle
  • Controls for application, issuance, acceptance, renewal, re‑keying, modification, revocation/suspension, status services (CRL/OCSP), and end of subscription.
• Security controls
  • Physical controls, personnel and procedural controls, record archives, compromise and disaster recovery, and CA termination.
  • Technical controls such as key pair generation, private key protection, activation data, computer and network security, time stamping.
• Profiles and audits
  • Certificate, CRL and OCSP profile requirements and compliance audit procedures (frequency, scope, auditor independence).
• Legal and business matters
  • Fees, financial responsibility, confidentiality, privacy, IP, warranties, liability, dispute resolution and governing law.
• Model PKI disclosure statement
  • Template guidance for communicating PKI properties to relying parties.

Applications

ISO 17090-3:2021 is designed to guide secure use of digital certificates across healthcare use cases, including:

• Secure exchange of electronic health records (EHRs) and cross‑border patient data flows
• Authentication and signing for e‑prescriptions, clinical messaging and telemedicine
• Securing health information systems, device communications and interoperability gateways
• Implementing trustworthy Certification Authorities (CAs) that serve hospitals, health networks and national health services

Who Uses This Standard

• Healthcare IT architects and CISOs
• Certification Authority operators servicing healthcare
• Health system integrators and software vendors
• Regulators, auditors and compliance officers
• National health bodies planning cross‑border identity and trust frameworks

Related standards

• Other parts of the ISO 17090 series (complementary PKI guidance for healthcare)
• General PKI and cryptographic standards (ISO/IEC and regional standards) relevant to implementation and interoperability

Keywords: ISO 17090-3:2021, health informatics, public key infrastructure, PKI, certificate policy, certification authority, digital certificates, healthcare security, cross‑border communication, certificate management.