ISO 17090-4:2026

Overview

ISO 17090-4:2026, Health informatics - Public key infrastructure - Part 4: Digital signatures for healthcare documents is an international standard published by ISO, focusing on the secure exchange of healthcare information through the use of digital signatures. This document sets out minimum requirements and formats for generating and verifying digital signatures and related digital certificates, specifically within the context of healthcare. It is designed to support interoperability across national and international boundaries, ensuring the integrity, authenticity, and non-repudiation of healthcare documents in electronic form. By providing clear technical, operational, and policy guidelines, ISO 17090-4:2026 establishes a recognized framework for leveraging public key infrastructure (PKI) in healthcare environments.

Key Topics

• Interchangeability of Digital Signatures
  Defines minimum requirements and standardized formats to ensure digital signatures can be exchanged reliably within and across different healthcare domains.

• Compliance with PKI Policy
  Outlines how provable compliance with public key infrastructure policies is achieved, enhancing trust between healthcare organizations and jurisdictions.

• Long-term Signature Formats
  Specifies methods for adopting advanced long-term digital signature formats - including CAdES (CMS Advanced Electronic Signature), XAdES (XML Advanced Electronic Signature), PAdES (PDF Advanced Electronic Signature), and JAdES (JSON Advanced Electronic Signature) - to maintain document integrity and evidentiary value over time.

• Verification Processes
  Details processes for validating digital signatures, timestamps, and certificates to prevent incorrect, unauthorized, or illegal signatures, as well as methods for ensuring signature authenticity.

• Healthcare-Specific PKI Profiles
  Introduces healthcare-specific profiles (HPKI) for the above-mentioned advanced signature standards, aligned with current ISO and ETSI guidelines, to address unique needs in patient data handling and clinical communications.

Applications

The guidelines and requirements in ISO 17090-4:2026 are highly relevant for:

• Healthcare Providers and Organizations
  Hospitals, clinics, and healthcare networks can securely exchange patient data, prescriptions, and medical records, ensuring data authenticity and compliance with legal and industry standards.

• Health Information Exchanges (HIEs)
  Enables interoperable digital certificate-enabled communications between disparate health information systems, both nationally and internationally.

• EHR and Health IT Vendors
  Software developers creating electronic health record (EHR) systems or medical information management tools can implement standardized digital signature processes for document integrity and regulatory compliance.

• Healthcare Regulators and Policy Makers
  Provides a trusted model for national or regional deployment of digital certificates in healthcare, supporting both domestic interoperability and cross-border patient information exchange.

• Long-term Preservation of Medical Records
  Ensures that digitally signed healthcare documents retain their integrity and can be validated years after creation, supporting audit trails and legal evidentiary requirements.

Related Standards

Organizations implementing ISO 17090-4:2026 should also consider the following related standards for a comprehensive approach to healthcare information security:

• ISO 17090-1: Health informatics - Public key infrastructure - Part 1: Overview of digital certificate services
  Provides foundational concepts, terminology, and the overall framework for healthcare PKI.

• ISO 17090-2 and ISO 17090-3: Define certificate profiles and certificate policy requirements in healthcare, supplementing the implementation of digital signatures.

• ISO 14533-2:2021: Processes, data elements, and documents in commerce, industry, and administration - Long term signature - Part 2: Profiles for XML Advanced Electronic Signatures (XAdES)

• ETSI CAdES, XAdES, PAdES, JAdES Standards: European Telecommunications Standards Institute profiles for advanced electronic signatures in various data formats (CMS, XML, PDF, JSON).

Conclusion

By conforming to ISO 17090-4:2026, stakeholders in the healthcare sector can ensure that digital signatures on electronic healthcare documents are consistent, secure, interoperable, and legally sound. The standard enables global interoperability, supports the long-term preservation of digital evidence, and strengthens trust in electronic health information exchange through robust PKI-based solutions. This is essential for enhancing patient privacy, regulatory compliance, and the efficiency of digital health systems.