National Health Reform

Concept of Operations: Relating to the introduction of a Personally Controlled Electronic Health Record System

5.3 Security

Trust is one of the many critical success factors for the PCEHR System. Therefore it is essential to ensure that:

• People seeking access to information are who they claim to be.
• Information received from a claimed person is from that person.
• Information transmitted across networks is appropriately encrypted and has arrived at its destination point without being tampered with.
• Access to information is appropriately authorised.

A multi-layered approach will safeguard the PCEHR System, and accordingly the system’s Security and Access Framework will need to incorporate both technical and non-technical controls. These include:

• Accurate authentication of users accessing the PCEHR System.
• Robust audit trails.
• Proactive monitoring of access to the PCEHR System to detect suspicious and inappropriate behaviour.
• Rigorous security testing, to be conducted both prior to and after commencement of operation of the PCEHR System.
• Education and training of users of the system.
• Requirements that all participants and organisations comply with relevant system rules, specifications and legal requirements.

The Security and Access Framework for the PCEHR System will ensure that the confidentiality, integrity and availability of information within the PCEHR System are not compromised.

Security has been designed to be ‘fit for purpose’, and to address health and information policy objectives. The objective of the PCEHR System Security and Access Framework is to:

• Minimise the risk of unauthorised access to the PCEHR System and the information it contains.
• Enable detection of unauthorised information access or modification, and any other breach of information security (including privacy).
• Facilitate appropriate response to, and investigation of, any such breaches.
• Assure the continued availability of the PCEHR System.
• Provide a means to continually improve security protections (including protection of privacy, confidentiality, integrity and availability).

The completion of a security and access framework is contingent on the assessment of a full range of personal, logical/systems and physical security threats and risks to be assessed and a layered set of solutions be implemented to address these threats and risks. The following frameworks will be used as inputs into that assessment process:

• Attorney-General, Protective Security Policy Framework (PSPF) [AG2010];
• Attorney-General, National Identity Security Strategy [AG2010];
• Department of Finance and Deregulation, National E-Authentication Framework (NEAF) [DOFD2009];
• NEHTA Security and Access Framework [NEHT2011b]²¹

---

²¹ The NEHTA Security and Access Framework is a profile of best practices in information security management standards, and includes general risk management guidelines [ISO/IEC 27001], security management in health [ISO27799] and the Standards Australian handbook on information security management in the health sector (HB 174).

Top of page