Nick Vennaro, NHIN Team (Contractor), Office of the National Coordinator for Health IT

Michael Torppey, CONNECT Health IT Security Specialist (Contractor) Federal Health Architecture, Office of the National Coordinator for Health IT

Security and Privacy for the NHIN and CONNECT

1

WEDNESDAY, 5:00 – 5:30PM

Agenda

Welcome• Nationwide Health Information Network (NHIN)• NHIN Architectural Components• NHIN Network Gateway Components

CONNECT Gateway Reference Implementation:• FHA CONNECT Certification & Accreditation (C&A) and Security

Management Program Overview• C&A Procedure/Status• CONNECT Security Management Program

HIMSS 2010 2

Nationwide Health Information Network (NHIN)

NHIN• NHIN is not a database

• Harmonized standards to exchange health data

• Membership agreements

• SSL Certificates

• Services Registry

• Test Environment – Interop and conformance

HIMSS 2010 3

NHIN Components

Components

• NHIN Network – Zone for transporting health info between gateways – Certificates, Services Registry, agreements, Test Environment, Specifications

• Gateway – Systems that implement NHIN Specifications

• Intra-HIO Zone – Systems within the HIO

• Patient Facing Zone – Interface with patient. Provider system or Personal health record

HIMSS 2010 4

Patient-facingZone

Intra-HIOZone

Trust FabricAgreements, Policy & Governance

Trust FabricAgreements, Policy & Governance

NHIN SecurityNHIN Security HI SecurityHI Security Provider SecurityProvider SecurityProvider SecurityProvider Security HI SecurityHI Security

Patient-facingZone

Intra-HIOZone

NHIN Network

Gateway

Gateway

Gateway

Gateway

ProviderProvider

PatientPatient PHRPHR PHRPHR

EHREHR

EHREHR

LabLab LabLab

EHREHR

Gateway

Certificate Authority

provides secure SSL Certificates

for Gateways ProviderProvider

PatientPatient

Gateway

NHIN Components – Architectural View

HIMSS 2010 5

NHIN Security Infrastructure – Managed PKI

• Entrust – Certificate Authority

• mPKI software/service to manage SSL certificates

• SSL worldwide standard

• Certificates encryption between gateways

• Certificates insure HIO has been vetted by NHIN

HIMSS 2010 6

or

Server

1

2

4

3

NHIN SecurityData Use Reciprocal Support Agreement (DURSA)

• Part of the chain of trust

• Trust agreement signed by HIO

• Legal framework for NHIN participation

• Confidentiality, performance, data use, etc

HIMSS 2010 7

NHIN Security – HIO Security Guidelines

• Non-binding best practice security guidelines for HIO

• Foundational security elements to a secure system– Network security

– Firewalls

– Message security

– Where to get more info

HIMSS 2010 8

NHIN Network Gateway Component Services Registry - UDDI

• Universal Description Discovery and Integration

• Service listings and associated meta data

• Hosted Systinet Solution

• Maintained by NHIN

• Production and test platform

HIMSS 2010 9

NHIN Network Gateway Component Test Environment

• Interoperability Testing – can the HIO successfully participate in a data exchange

• Conformance Testing – does the HIO conform to the specifications

• Methods, process, procedures, and environment to test gateway software

HIMSS 2010 10

(Internet employing CA/UDDI)

(Internet employing CA/UDDI)

NHINInteroperability

Testing Lab

NISTConformance

Tools

1 2

Candidate System

Candidate System

CONNECT Reference System (CRS) Certification & Accreditation (C&A) and Security Management Overview

11

CONNECT C&A - Procedure

• A thorough understanding of the risk that the system presents to the business\technical operations of federal partners and public & private organizations

• A full set of C&A documentation (system security plan, security artifacts, reports, data, etc.)

• A Security Test and Evaluation (ST&E) was conducted to verify that all controls are implemented and performing as described

• Identification, categorization and prioritization of action items (POAMs) to address and monitor “weaknesses”

• An Authorization to Operate (ATO) from the HHS Designated Approval Authority (DAA)

• Continuous Monitoring - combines input from C&A with planned lifecycle development & systems operations processes to maintain security posture

12HIMSS 2010

CONNECT C&A - Status

• CRS ver. 2.1 C&A package completed, delivered and reviewed by the HHS Certifying Authority, Dan Galik (HHS CISO) on 1/15/2010

• Approved on 1/22/2010 by the HHS Designated Approval Authority (DAA), Michael Carleton (HHS CIO) with an Authorization to Operate (ATO) granted

• CRS ver. 2.2 has been through a “Change Risk Assessment” which was reviewed and approved by the CRS Business Owner and Information System Security Officer (ISSO)

• CRS ver. 2.3 re-assessment is in process

• Future releases of CRS will be re-assessed in accordance with the CRS Continuous Monitoring Plan

13HIMSS 2010

CONNECT Security Management Program

Continuous Risk Management• Risk Assessment and Security Planning Policies & Procedures• Risk Analysis as part of the development cycle• Periodic Risk Assessments

Risk Mitigation• Vulnerability scanning• Patching• Incident response coordination• Feedback loop with installed base

Security Controls and Continuous Monitoring• FISMA controls cover a wide breadth of technical,

management and operational safeguards• ST&E, POAMs and Re-Assessments

C&A and the Non-Federal Community

14HIMSS 2010

CONNECT C&A: Extended ImpactOperational Security Impact – Security Program

• A one-time, narrowly enforced C&A effort misses overlap opportunities with security program management and risk management requirements

• Opening up C&A by including continuous monitoring blends the complementary security goals of compliance and ongoing operational security

• Doing so will also leverage the spending and resource time spent on compliance into effective and efficient ongoing security practices

HIMSS 2010 15

C&A Process – System Information Revealed

information types contained

relative importance of the system to the organization

security controls that protect the system

system risks

system boundaries

Operational Security Impact:

Configuration baselines

Implementation guidelines

“Defensive” mechanisms (IDS, firewall rule sets, etc.)

Repeated

CONNECT C&A – Extended ImpactOperational Security Impact – Monitoring

HIMSS 2010 16

C&A – Continuous Monitoring Strategy

Continuous Monitoring Methods

Automated processes

IT management systems

C&A re-assessment

Periodic audits

Select controls & monitoring approach

System baseline categorization

Control effectiveness

Impact of system or environment change

Operational Security Impact:

Vulnerability discovery and mitigation

Continual update of SSP and ST&E documents

More efficient risk analysis and resource planning

Thank You

17

The participation of any company or organization in the NHIN and CONNECT area within the HIMSS Interoperability showcase

does not represent an endorsement by the Office of the National Coordinator for Health Information Technology, the Federal

Health Architecture or the Department of Health and Human Services.