SIST EN ISO 13606-5:2010

SLOVENSKI STANDARD
SIST EN ISO 13606-5:2010
01-junij-2010
=GUDYVWYHQDLQIRUPDWLND.RPXQLNDFLMD]HOHNWURQVNLPL]DSLVLQDSRGURþMX
]GUDYVWYDGHO6SHFLILNDFLMDYPHVQLND,62
Health informatics - Electronic health record communication - Part 5: Interface
specification (ISO 13606-5:2010)
Medizinische Informatik - Kommunikation von Patientendaten in elektronischer Form -
Teil 5: Nachrichten für den Informationsaustausch (ISO 13606-5:2010)
Informatique de santé - Communication du dossier de santé informatisé - Partie 5:
Spécification d'interfaces (ISO 13606-5:2010)
Ta slovenski standard je istoveten z: EN ISO 13606-5:2010
ICS:
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
SIST EN ISO 13606-5:2010 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST EN ISO 13606-5:2010

---------------------- Page: 2 ----------------------

SIST EN ISO 13606-5:2010


EUROPEAN STANDARD
EN ISO 13606-5

NORME EUROPÉENNE

EUROPÄISCHE NORM
March 2010
ICS 35.240.80
English Version
Health informatics - Electronic health record communication -
Part 5: Interface specification (ISO 13606-5:2010)
Informatique de santé - Communication du dossier de Medizinische Informatik - Kommunikation von
santé informatisé - Partie 5: Spécification d'interfaces (ISO Patientendaten in elektronischer Form - Teil 5: Nachrichten
13606-5:2010) für den Informationsaustausch (ISO 13606-5:2010)
This European Standard was approved by CEN on 13 February 2010.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the CEN Management Centre or to any CEN member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the same status as the
official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland,
Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.






EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2010 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 13606-5:2010: E
worldwide for CEN national Members.

---------------------- Page: 3 ----------------------

SIST EN ISO 13606-5:2010
EN ISO 13606-5:2010 (E)
Contents Page
Foreword .3

2

---------------------- Page: 4 ----------------------

SIST EN ISO 13606-5:2010
EN ISO 13606-5:2010 (E)
Foreword
This document (EN ISO 13606-5:2010) has been prepared by Technical Committee CEN/TC 251 “Health
informatics”, the secretariat of which is held by NEN, in collaboration with Technical Committee ISO/TC 215
"Health informatics".
This European Standard shall be given the status of a national standard, either by publication of an identical
text or by endorsement, at the latest by September 2010, and conflicting national standards shall be
withdrawn at the latest by September 2010.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent rights.
According to the CEN/CENELEC Internal Regulations, the national standards organizations of the following
countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech
Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain,
Sweden, Switzerland and the United Kingdom.

3

---------------------- Page: 5 ----------------------

SIST EN ISO 13606-5:2010

---------------------- Page: 6 ----------------------

SIST EN ISO 13606-5:2010

INTERNATIONAL ISO
STANDARD 13606-5
First edition
2010-03-01

Health informatics — Electronic health
record communication —
Part 5:
Interface specification
Informatique de santé — Communication du dossier de santé
informatisé —
Partie 5: Spécification d'interfaces




Reference number
ISO 13606-5:2010(E)
©
ISO 2010

---------------------- Page: 7 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but
shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In
downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat
accepts no liability in this area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation
parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In
the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.


COPYRIGHT PROTECTED DOCUMENT


©  ISO 2010
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland

ii © ISO 2010 – All rights reserved

---------------------- Page: 8 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
Contents Page
Foreword .iv
Introduction.v
1 Scope.1
2 Conformance .1
3 Terms and definitions .2
4 Abbreviated terms .5
5 Interactions .6
6 Interfaces.8
6.1 Interface: REQUEST_EHR_EXTRACT .8
6.2 Interface: REQUEST_ARCHETYPES .10
6.3 Interface: REQUEST_EHR_AUDIT_LOG_EXTRACT .12
6.4 Term lists.14
Bibliography.15

© ISO 2010 – All rights reserved iii

---------------------- Page: 9 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies
(ISO member bodies). The work of preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of technical committees is to prepare International Standards. Draft International Standards
adopted by the technical committees are circulated to the member bodies for voting. Publication as an
International Standard requires approval by at least 75 % of the member bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights.
ISO 13606-5 was prepared by Technical Committee ISO/TC 215, Health informatics, and by Technical
Committee CEN/TC 251, Health informatics in collaboration.
ISO 13606 consists of the following parts, under the general title Health informatics — Electronic health record
communication:
⎯ Part 1: Reference model
⎯ Part 2: Archetype interchange specification
⎯ Part 3: Reference archetypes and term lists
⎯ Part 4: Security [Technical Specification]
⎯ Part 5: Interface specification

iv © ISO 2010 – All rights reserved

---------------------- Page: 10 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
Introduction
This part of ISO 13606 defines the interfaces by which an EHR_EXTRACT, an ARCHETYPE or an
EHR_AUDIT_LOG_EXTRACT may be requested and provided.
The scope of this part of ISO 13606 has been considered carefully in order to achieve several objectives:
⎯ to specify those interfaces that are unique to the ISO 13606 context, and not to include more generic
health information communication interfaces that might be the scope of other standards and
specifications;
⎯ to specify the interfaces in ways that are compatible with the HISA standard (ISO 12967) and, in
particular, to define these interfaces as specializations of HISA ISO 12967-3 interfaces;
⎯ to specify the interfaces as a pure RM-ODP Computational Viewpoint, in order to support the wide range
of engineering viewpoints that might be adopted by individual vendors or eHealth programmes; (it should
be noted that ISO 13606-1, ISO 13606-2 and ISO 13606-4 define the corresponding Information
Viewpoints, and that ISO/TS 18308 defines the corresponding Enterprise Viewpoint);
⎯ to construct these interfaces such that they might easily be implemented as specializations of standard
interfaces within the commonly used engineering languages such as Java, Visual Basic, dotnet, SOAP,
ebXML, etc.;
⎯ to work through the Joint SDO Initiative and Council on the production of Engineering Viewpoint
Implementation Guides, that will define more specifically how to implement these interfaces; (e.g. in
HL7 3); these guides will be published separately from this part of ISO 13606, to enable them to be
maintained and updated more frequently (to reflect implementation experience) than is possible for a
standard;
⎯ to recognise that EHR communication will be implemented within a healthcare communications
infrastructure, usually nationally, that will define a generalized approach to many other complementary
and necessary services such as patient demographics registries, provider registries, authentication and
authorization policies and services, etc.; these are therefore not part of the formal scope of this part of
ISO 13606 but are referred to as being assumed and necessary complementary services;
⎯ to assume that an ISO/TS 22600 (PMAC) compatible architecture or its equivalent will be used for
managing security services, and not to duplicate or conflict with these services in this part of ISO 13606;
⎯ to further support the protection of patient privacy by avoiding the need to reveal whether any EHR data
have been withheld by the provider when responding to a request;
⎯ to enable each interface and term set to be extended locally to cater for specialized circumstances of
EHR communication, in which additional requirement constraints might apply.
This part of ISO 13606 defines a set of interfaces by which the artefacts defined in ISO 13606-1, ISO 13606-2
and ISO 13606-4 can be requested and provided:
a) ISO 13606-1 defines a reference model for an EHR_EXTRACT: part or all of the EHR of a subject of
care;
b) ISO 13606-2 defines an information model for an ARCHETYPE, and optionally a serialized form
represented using Archetype Definition Language;
c) ISO 13606-4 defines an EHR_AUDIT_LOG_EXTRACT to communicate the audit log activity history
pertaining to part or all of an EHR.
© ISO 2010 – All rights reserved v

---------------------- Page: 11 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
(ISO 13606-3 defines term lists and reference archetypes, to which a direct interface is not required.
ISO 13606-4 defines an access policy model to which a direct interface is also not required.)
This part of ISO 13606 defines three interfaces, one for each of a) to c) above, as a communication between
an EHR_requester (wishing to and authorizing the communication of the artefact), an EHR_provider (a
repository service that contains and can return the requested artefact) and an EHR_recipient who is intended
and authorized to receive the artefact (usually but not always the same as the EHR_requester). In terms of the
HISA standard, ISO 12967, these interfaces are all specializations of the Detail Basic Methods defined in
ISO 12967-3.
These interfaces are all expressed as ODP Computational Viewpoint specifications, and aim to support
implementation through many different Engineering Viewpoint (transport) formalisms, such as message
protocols (e.g. EDIFACT, HL7 3) or service protocols (e.g. SOAP, Java RMI). This part of ISO 13606 therefore
specifies only the “payload” information to be communicated at each interface. Attributes such as message
identifiers, message time-stamping and message version management are normally defined and handled by
each kind of transport protocol in particular ways, and this part of ISO 13606 therefore does not define its own
duplication of this kind of information. It should be noted that the EHR_EXTRACT defined in ISO 13606-1, the
ARCHETYPE defined in ISO 13606-2, and the EHR_AUDIT_LOG_EXTRACT defined in ISO 13606-4 all
include time-stamping, authorship and version management information of the payload data as part of their
information models.
Request acknowledgements and system/communication error messages are routinely handled by most
engineering transport protocols. It is therefore not appropriate that this part of ISO 13606 duplicate these. An
optional exception is defined to communicate back to the EHR_requester a reason why a request has been
received but refused, if it is legitimate to reveal this without breaching confidentiality.
The EHR_requester will need to authenticate to the EHR_provider in ways that are to be locally determined,
and will present authorization credentials that are also beyond the scope of this part of ISO 13606 but are
specified in ISO/TS 22600 (PMAC). It is recognised that there may be times when an EHR_requester wishes
the EHR_provider to “send” the EHR_EXTRACT to a third party. This part of ISO 13606 may be used within a
delegation architecture, in which an EHR_requester acts on behalf of another party, but the representation
and communication of the hierarchy of authorizations involved in delegation is a matter for the privilege
management and access control architecture and does not directly impact on this part of ISO 13606.
Alternatively, local arrangements may be made to securely communicate to a third party a unique reference
for any particular RECORD_COMPONENT (e.g. for a particular letter or discharge summary, via the ehr-id
and rc_id of the COMPOSITION) that the third party is recommended to and has permission to access directly,
without therefore requiring the use of delegation.
A set of Implementation Guides is being developed to define how this part of ISO 13606 should be
implemented within particular communications/transport standards. The first of these is expected to be for
HL7 3, to be published and maintained by HL7.

vi © ISO 2010 – All rights reserved

---------------------- Page: 12 ----------------------

SIST EN ISO 13606-5:2010
INTERNATIONAL STANDARD ISO 13606-5:2010(E)

Health informatics — Electronic health record
communication —
Part 5:
Interface specification
1 Scope
This part of ISO 13606 specifies the information architecture required for interoperable communications
between systems and services that need or provide EHR data. This part of ISO 13606 is not intended to
specify the internal architecture or database design of such systems.
The subject of the record or record extract to be communicated is an individual person, and the scope of the
communication is predominantly with respect to that person's care.
Uses of healthcare records for other purposes such as administration, management, research and
epidemiology, which require aggregations of individual people's records, are not the focus of this part of
ISO 13606, but such secondary uses could also find this document useful.
This part of ISO 13606 defines a set of interfaces to request and provide:
an EHR_EXTRACT for a given subject of care as defined in ISO 13606-1;
⎯
one or more ARCHETYPE(s) as defined in ISO 13606-2;
⎯
an EHR_AUDIT_LOG_EXTRACT for a given subject of care as defined in ISO/TS 13606-4.
⎯
This part of ISO 13606 defines the set of interactions for requesting each of these artefacts, and for providing
the data to the requesting party or declining the request. An interface to query an EHR or populations of EHRs,
for example for clinical audit or research, are beyond its scope, although provision is made for certain
selection criteria to be specified when requesting an EHR_EXTRACT which might also serve for population
queries.
This part of ISO 13606 defines the Computational Viewpoint for each interface, without specifying or
restricting particular engineering approaches to implement these as messages or as service interfaces.
This part of ISO 13606 effectively defines the payload to be communicated at each interface. It does not
specify the particular information that different transport protocols will additionally require, nor the security or
authentication procedures that might be agreed between the communicating parties or required by different
jurisdictions.
2 Conformance
2.1 A message or service interface that serves to request part or all of the EHR of a subject of care shall
include all of the information specified as mandatory in 6.1, and may include any of the information specified
as optional in 6.1. An EHR_provider shall be able to receive and process all of the mandatory and optional
parameters in the request. The provision of an EHR_EXTRACT in response to this request, or the refusal to
do so, shall conform to 6.1.
© ISO 2010 – All rights reserved 1

---------------------- Page: 13 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
2.2 A message or service interface that serves to request one or more Archetypes shall include all of the
information specified as mandatory in 6.2, and may include any of the information specified as optional in 6.2.
An EHR_provider shall be able to receive and process all of the mandatory and optional parameters in the
request. The provision of ARCHETYPES in response to this request, or the refusal to do so, shall conform to
6.2.
2.3 A message or service interface that serves to request part or all of the Audit Log pertaining to an EHR
of a subject of care shall include all of the information specified as mandatory in 6.3, and may include any of
the information specified as optional in 6.3. An EHR_provider shall be able to receive and process all of the
mandatory and optional parameters in the request. The provision of an EHR_AUDIT_LOG_EXTRACT in
response to this request, or the refusal to do so, shall conform to 6.3.
2.4 The information specified in 6.1 to 6.3 may be included as parameters, arguments or message
segments within the communications artefact, as appropriate to the engineering paradigm adopted. These
interfaces may be locally extended to include additional information that is locally relevant, but such
extensions cannot be mandated outside of the jurisdiction in which they have been agreed.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
3.1
access control
means of ensuring that the resources of a data processing system can be accessed only by authorized
entities in authorized ways
[ISO/IEC 2382-8:1998, definition 08.04.01]
3.2
accountability
property that ensures that the actions of an entity may be traced uniquely to that entity
[ISO/IEC 2382-8:1998, definition 08.01.10]
3.3
archetype instance
individual metadata class instance of an archetype model, specifying the clinical concept and the value
constraints that apply to one class of record component instances in an electronic health record extract
3.4
archetype model
information model of the metadata to represent the domain-specific characteristics of electronic health record
entries, by specifying values or value constraints for classes and attributes in the electronic health record
reference model
3.5
archetype repository
persistent repository of archetype definitions, accessed by a client authoring tool or by a run-time component
within an electronic health record service
3.6
attester
party (person) who certifies and records legal responsibility for a particular unit of information
3.7
attestation
process of certifying and recording legal responsibility for a particular unit of information
2 © ISO 2010 – All rights reserved

---------------------- Page: 14 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
3.8
audit trail
chronological record of activities of information system users which enables prior states of the information to
be faithfully reconstructed
[ISO 13606-1:2008, definition 3.9]
3.9
authentication
process of reliably identifying security subjects by securely associating an identifier and its authenticator
3.10
authorization
granting of rights
3.11
committed
information that has been persisted within an electronic health record system and which constitutes part of the
electronic health record of a subject of care
[ISO 13606-1:2008, definition 3.14]
3.12
committer
agent (party, device or software) whose direct actions have resulted in data being committed to an electronic
health record
[ISO 13606-1:2008, definition 3.15]
3.13
confidentiality
property that information is not made available or disclosed to unauthorized individuals, entities, or processes
[ISO 7498-2:1989, definition 3.3.16]
3.14
digital signature
data appended to, or a cryptographic transformation of, a data unit that allows a recipient of the data unit to
prove the source and integrity of the unit and protect against forgery e.g. by the recipient
[ISO 7498-2:1989, definition 3.3.26]
3.15
distributed processing
information processing in which discrete components may be located in different places
3.16
electronic health record extract
part or all of the electronic health record of a subject of care, communicated in compliance with ISO 13606
3.17
electronic health record information architecture
ODP Information Viewpoint specification of an electronic health record
3.18
electronic health record provider
entity in legitimate possession of electronic health record data and in a position to communicate it to another
appropriate entity
© ISO 2010 – All rights reserved 3

---------------------- Page: 15 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
3.19
electronic health record recipient
entity to whom electronic health record data are communicated by an electronic health record provider
3.20
electronic health record requester
entity initiating a request for electronic health record communication to take place between an electronic
health record provider and an electronic health record recipient
3.21
electronic health record system
system for recording, retrieving, manipulating and processing information in electronic health records
3.22
federated health record
virtual view of a patient's health record that can be obtained from all electronic health record entries about that
patient that are held by different systems in communication using standard electronic health record extracts
3.23
feeder system
repository (for health record data) that may be queried within a federation of electronic health record systems
in order to contribute to a federated health record
3.24
healthcare agent
person, device or software that performs a role in a healthcare activity
[EN 13940-1:2007]
3.25
healthcare device
device or equipment involved in the direct or indirect provision of healthcare services to an individual or to a
population
3.26
healthcare organization
organization involved in the direct or indirect provision of healthcare services
NOTE Groupings or subdivisions of an organization, such as departments, may also be considered as organizations
where there is a need to identify them.
3.27
healthcare party
person involved in the direct or indirect provision of healthcare services
3.28
healthcare service
service provided with the intention of directly or indirectly improving the health of the person or populations to
whom it is provided
3.29
non-repudiation
service providing proof of the integrity and origin of data (both in an unforgeable relationship), which can be
verified by any party
[ISO 17090-1:2008, definition 3.2.21]
3.30
persistent data
data which are stored on a permanent basis
4 © ISO 2010 – All rights reserved

---------------------- Page: 16 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
3.31
privacy
freedom from intrusion into the private life or affairs of an individual when that intrusion results from undue or
illegal gathering and use of data about that individual
[ISO/IEC 2382-8:1998, definition 08.01.23]
3.32
record component
part of the electronic health record extract of a single subject of care, represented as a node within a
hierarchical data structure conforming to ISO 13606
[ISO 13606-1:2008, definition 3.43]
3.33
role
name of a set of behaviours which is associated with a task
NOTE Adapted from ISO 17090-1.
3.34
shareable electronic health record
electronic health record with a standardized information model which is independent of electronic health
record systems and is accessible by multiple authorized users
3.35
standard
document, established by consensus and approved by a recognized body, that provides, for common and
repeated use, rules, guidelines or characteristics for activities or their results, aimed at the achievement of the
optimum degree of order in a given context
[ISO/IEC Guide 2:2004, definition 3.2]
3.36
state
〈of a process〉 condition or situation during the lifecycle of an object during which it satisfies some condition,
performs some activity or waits for some event
[ISO/TS 18308:2004, definition 3.39]
3.37
subject of care
person scheduled to receive, receiving or having received healthcare
4 Abbreviated terms
For the purposes of this document, the following abbreviated terms apply.
⎯ CEN Comité Européen de Normalisation (European Committee for Standardization)
⎯ EHR electronic health record
⎯ HISA Health Informatics Service Architecture (acronym used for EN 12967)
⎯ HL7 Health Level Seven
⎯ ISO International Organization for Standardization
⎯ ODP Open Distributed Processing (ISO/IEC 10746-4, used for describing distributed systems)
© ISO 2010 – All rights reserved 5

---------------------- Page: 17 ----------------------

SIST EN ISO 13606-5:2010
ISO 13606-5:2010(E)
5 Interactions
The five parts of ISO 13606 define the way in which
part or all of the EHR (an EHR_EXTRACT, as defined in ISO 13606-1),
⎯
an Archetype (an ARCHETYPE, as defined in ISO 13606-2) and
⎯
an Audit Log (an EHR_AUDIT_LOG_EXTRACT, as defined in ISO 13606-4)
⎯
may be communicated. ISO 13606-1, ISO 13606-2, ISO 13606-3 and ISO 13606-4 specify the informa
...