ISO 22600-1:2014

Overview - ISO 22600-1:2014 (Health informatics, Privilege management and access control)

ISO 22600-1:2014 defines high-level principles and services for privilege management and access control in health informatics, with a focus on secure health information exchange across organisational and policy domain boundaries. Part 1 provides an introduction to the framework, proposes a policy agreement template, and describes the documentation and governance needed to enable interoperable, auditable information sharing between unaffiliated providers, insurers, patients, staff and application systems. Cryptographic protocols and platform-specific implementation details are intentionally out of scope.

Key technical topics and requirements

ISO 22600-1 highlights component-based concepts and policy management requirements important for secure, cross-domain access control:

• Policy agreement: template and clauses covering identification, patient consent, privacy, authorization and validity periods.
• Authentication & identification: requirements for identifying principals (users and system agents).
• Authorization and role structures: mapping roles, delegation rights, assignment and attestation authorities.
• Information controls: identification, location, integrity and purpose-of-use rules for data access.
• Policy repository & directory services: conceptual services for storing rules and identifying principals to support cross-border access.
• Auditability and secure audit trail: logging, audit checks and documentation to support compliance and forensics.
• Risk analysis & continuity: requirement to record risks, mitigation plans, disaster recovery and continuity management.
• Documentation & governance: negotiation records, policy agreements, and templates (Annex A/B examples in the standard).

Practical applications and who uses it

ISO 22600-1 is a practical reference for organizations designing or governing health information exchange:

• Health IT architects & developers - use the conceptual services and policy templates to design interoperable access-control solutions.
• Security & privacy officers - base policy agreements, risk analyses and audit requirements on the standard.
• Healthcare providers & hospitals - define cross-organization sharing rules (consent, purpose-of-use, role translations).
• Health insurers & regional/national authorities - harmonize access policies across domains and jurisdictions.
• Vendors & integrators - align implementations with Parts 2 and 3 for formal models and concrete implementations.

Practical uses include drafting interoperable policy agreements, mapping role-based access across organisations, documenting consent and privacy controls, and establishing audit and continuity requirements for shared electronic health records.

Related standards

• ISO 22600 series: Part 2 (Formal models) and Part 3 (Implementations)
• Other ISO/TC 215 references: ISO 17090, ISO 22857, ISO 21091, ISO 21298 - for complementary identity, security and directory specifications.

Keywords: ISO 22600-1, privilege management, access control, health informatics, policy agreement, health information exchange, role-based access control, patient consent, audit trail.