ASTM E1985-98(2005) pdf free download.Standard Guide for User Authentication and Authorization.
ASTM E1985-98(2005) covers mechanisms that may be used to authenticate healthcare information (both administrative and clinical) users to computer systems, as well as mechanisms to authorize particular actions by users. These actions may include access to healthcare information documents, as well as specific operations on those documents (for example, review by a physician).
4. Significance and Use
4.1 This guide has three purposes:
4.1.1 To serve as a guide for developers of computer software that provides or makes use of authentication and authorization processes.
4.1.2 To serve as a guide to healthcare providers who are implementing authentication and authorization mechanisms, and
4.1.3 To be a consensus standard on the design. implemenLation. and use of authentication and authorization mechanisms.
6. 1 Requirements:
6.1.1 Three types of authorization are required based on organizational policy:
6.1.1.1 Users shall be authorized to access (read or write) healthcare information documents;
6.1.1.2 Users shall be authorized to perform application- specific actions on a document (for example, physician review); and
6.1.1.3 Users shall be able to determine whether all necessary actions have been performed on the document, and whether the users performing these actions were allowed to do so, according to any rules and limits agreed to by the parties involved. For example. it may he a requirement that documents shall he reviewed by a physician prior to inclusion in the medical record.
6.1.2 A user’s application-specific action on a document will be indicated using an electronic signature, as defined in Guide E 1762. Particular actions are indicated using signature purposes. Thus, signatures are applied in 6.1.1.2, and verified in 6.1.1.3. Generic access as described in 6.1. I . I may be indicated using signatures, but this is not a requirement. This type of access may be needed to perform the specific actions of 6.1.1.2.