User Manual Part 1

39
2852 A EN 20070205
DRYSTAR AXYS
Patient Data Security
It is the responsibility of the hospital to ensure that the patients’ legal require-
ments are met and that the security of the patient records is:
Q maintained and tested,
Q audited,
Q administered locally to cover risks from third party access and
Q how the availability of the services is to be maintained in the event of disaster.
It is the responsibility of the hospital to ensure that types of access are identi-
fied, classified and reasons for access are justified.
Node authentication, certificates and Certification
Authority
Each device - connected to a network - will receive a unique identifier: the
X.509 certificate, a digital passport. Any device on the network is only allowed
to communicate with another node of which it is holding the certificate in a
‘communication allowed’ table.
A Certification Authority (CA) is responsible for creating a certificate. The CA
can be the hospital, Agfa or a third party.
This CA distributes the certificate to the hospital security responsible or service
technician, who for his part:
Q Imports the device certificate, created by the CA.
Q Imports the certificates of all peer devices with which communication is autho-
rized, i.e. creates the list of ‘communication allowed’ device certificates.