ISO 22600-3:2014

Overview

ISO 22600-3:2014 - part of the ISO 22600 series on health informatics, privilege management, and access control - provides implementation-level guidance for managing access to health data and functions across organizational and policy boundaries. Building on the formal models in ISO 22600‑2, Part 3 instantiates requirements for policy repositories and privilege management infrastructures, and supplies concrete examples of how to represent and exchange policies using common syntaxes (e.g., XML derivatives).

Key Topics and Technical Requirements

• Privilege management infrastructure (PMI): Requirements and examples for repositories and directory services that store and publish access control policies and attributes.
• Policy repositories and representation: Implementation examples and models for storing access control policies, policy management and policy representation (see informative Annex D).
• Cross-policy-domain interoperability / policy bridging: Guidance to enable healthcare information sharing between unaffiliated providers, insurers, patients, staff and trading partners.
• Formal model instantiation: Practical examples that map the abstract models in ISO 22600‑2 to implementable specifications.
• Constraint and concept representation: Use of domain languages, OCL constraint modelling and other constraint representations for policy semantics.
• Consent and emergency access: Considerations and examples for patient consent management and emergency access workflows.
• Delegation and control model refinement: Implementation guidance for delegation patterns and refining authorization controls.
• Specification languages and encodings: Examples using SAML and XACML (OASIS standards) and traditional ASN.1 encodings.
• Exclusions: The standard excludes platform-specific cryptographic and authentication protocol details and references other standards for those areas.

Practical Applications and Who Uses It

ISO 22600-3 is intended for implementers and stakeholders who need to operationalize cross-organizational access control in healthcare:

• Health IT architects and system integrators designing shared EHRs or SOA-based health platforms
• Vendor developers implementing authorization servers, policy repositories, and directory services
• Security officers and compliance teams establishing policy agreements and interoperability rules
• National and regional health authorities defining infrastructure for cross-border or multi-organization data sharing
• Identity and access management (IAM) teams integrating consent, delegation, and emergency access controls

Benefits include more consistent healthcare interoperability, reduced integration costs, and clearer models for managing sensitive patient information while respecting legal and ethical constraints.

Related Standards (select)

• ISO 22600‑1 (Overview & policy management)
• ISO 22600‑2 (Formal models)
• SAML, XACML (OASIS) - used for policy and assertion encoding
• Relevant ISO/IEC security/authentication standards (referenced for cryptographic and protocol services)

Keywords: ISO 22600-3, privilege management, access control, health informatics, policy repository, privilege management infrastructure, SAML, XACML, healthcare interoperability.