ISO 17090-4:2020

Overview

ISO 17090-4:2020 - "Health informatics - Public key infrastructure - Part 4: Digital signatures for healthcare documents" specifies minimum technical, operational and policy requirements to generate, verify and interoperate digital signatures and related certificates in healthcare. The standard aims to enable global interoperability of healthcare PKI (HPKI), support cross‑border exchange of health information, and provide guidance for long‑term signature formats to ensure integrity and non‑repudiation for long‑term electronic preservation.

Key topics and technical requirements

• Signature formats and profiles: Defines healthcare‑specific PKI profiles based on ETSI/ISO‑ETSI long‑term signature standards - CAdES, XAdES, and PAdES - and specifies requirements for profiles such as T (timestamp) and A (archive) variants.
• Generation and verification processes: Minimum requirements for creating ES/ES‑T/ES‑A style signatures, including trusted timestamping from a timestamp authority and procedures for verification (certification path validation and revocation checking).
• Certificate and policy compliance: Defines how to demonstrate provable compliance with a PKI policy in healthcare (HPKI), supporting trust frameworks between Certification Authorities (CAs) and Registration Authorities (RAs).
• Long‑term preservation: Methodology for adopting long‑term signature formats that protect integrity and non‑repudiation over time (important for medico‑legal records).
• Target systems and scope: Applies to digital signature libraries, standalone signature programs and verification programs used by medical applications; it excludes user interfaces and certain CSP/PKCS#11 implementation layers.
• Security of private keys: Assumes end‑entity private key storage meets hardware/software security expectations (examples include smart cards, USB tokens, software tokens; storage modules equivalent to or higher than FIPS 140‑2 Level 1 are assumed).

Practical applications and who uses it

ISO 17090-4:2020 is used to:

• Enable secure signing and cross‑jurisdictional exchange of EHRs, prescriptions, consent forms and clinical documents.
• Support EHR vendors, health information exchange (HIE) operators, hospitals and national health agencies in deploying interoperable digital signatures.
• Guide Certificate Authorities, Registration Authorities, PKI architects, and software developers implementing digital signature libraries and verification tools for healthcare.
• Assist archivists and legal teams in ensuring long‑term evidentiary value of electronic health records.

Related standards and keywords

• Related: ISO 17090‑1 (overview of digital certificate services), ETSI signature standards (CAdES/XAdES/PAdES), ISO/ETSI long‑term signatures.
• SEO keywords: ISO 17090-4:2020, health informatics, public key infrastructure, PKI, digital signatures healthcare, HPKI, CAdES, XAdES, PAdES, long‑term signature, interoperability, timestamp, certificate profiles.