×

To enhance security, Multi-Factor Authentication (MFA) is mandatory for all HL7 users. More information

Section 1e: Version 3 (V3)
Section 2: Clinical and Administrative Domains
Section 4: Rules and References

HL7 Version 3 Standard: Healthcare (Security and Privacy) Access Control Catalog, Release 3

DESCRIPTION

The Healthcare (Security and Privacy) Access Control Catalog is a new standard extending the current normative HL7 Role-based Access Control (RBAC) Permission Catalog standard.

The updates made to the normative RBAC standard add additional high-level concepts and vocabulary of Attribute-Based Access Control (ABAC) and Relationship-Based Access Control (ReBAC) to the previous RBAC Permission Catalog vocabulary, further extending access control flexibility.

ABAC and ReBAC are alternative access control methods that each have a unique set of permissions and clearances. The addition of ABAC and ReBAC attributes allows this standard to function with recently balloted Security WG projects--HL7 Healthcare Classification System (HCS) and the HL7 Security Labeling Service (SLS).

ALTERNATIVE NAMES

HL7 Version 3 Standard: Healthcare (Security and Privacy) Access Control Catalog, Release 3 may also go by the following names or acronyms:

V3 HACC R3,"HL7 Version 3 Standard: Role-based Access Control Healthcare Permission Catalog, Release 2","Role-Based Access Control Healthcare Permission Catalog, Release 1",V3,RBAC,Healthcare Access Control Catalog,HACC,Permission Catalog,, ABAC, ACHPCAT

TARGETS

  • Standards Development Organizations (SDOs)
  • Healthcare Information Technology (HIT) Vendors
  • HIT Systems Integrators
  • Healthcare Provider Organizations

BENEFITS

  • Enhances support for dynamic attributes such as time of day, which might need to be considered when determining user permissions beyond RBAC’s groups of users and permissions to support dynamic or other attributes

  • Enables the addition of attribute-based access control (ABAC) and relationship-based access control (ReBAC) as organized in the new standard, suggesting attributes, relationship and rules complement an RBAC implementation thus making it effectively simple and flexible

  • Ensures a flexible and scalable access control security component to healthcare enterprises with addition of ReBAC and ABAC to the original RBAC Healthcare Permission Catalog

     

     

IMPLEMENTATIONS/CASE STUDIES

  • Department of Veterans Affairs (VA)
  • Department of Defense (DoD)
  • SAMHSA

DEVELOPMENT BACKGROUND

For each access request, there are observable characteristics of the environment, such as the current time, day of the week, and location of a user. These characteristics are independent of subject or object and are known as environment conditions.

In utilizing ABAC, each subject, object and set of environment conditions has characteristics which are attributes. By leveraging environment conditions, ABAC policies can specify exceptional or dynamic access control rules that subject and object attributes cannot describe by themselves.  In using ABAC, no changes need to be made to existing access control rules or object attributes.

For some application domains, including that of healthcare, it is more natural to base access control decisions on whether the subject and object owner are in a particular kind of relationship. This type of access control method is known as Relationship-Based Access Control (ReBAC).

RELATED DOCUMENTS

HL7 Version 3 Standard: Healthcare (Security and Privacy) Access Control Catalog, Release 3

(Download)

ADDITIONAL DETAILS

The standard is also available as part of the Health Level Seven Version 3 (V3) Normative Edition. See the HL7 Version 3 Product Suite for downloads.

TOPIC

  • Security and Privacy

BALLOT TYPE

  • Normative

STATUS DATE

2016-10-05

RESPONSIBLE WORK GROUP

Security

STAKEHOLDER

  • Standards Development Organizations (SDOs)

FAMILY

  • V3

CURRENT STATE

  • Retired

REALM

  • Universal