This document describes a methodology for specifying the privileges necessary to access electronic health record (EHR) data. This methodology forms part of the overall EHR communications architecture defined in ISO 13606-1 [17].

This document seeks to address those requirements uniquely pertaining to EHR communications and to represent and communicate EHR-specific information that will inform an access decision. It also refers to general security requirements that apply to EHR communications and points to technical solutions and standards that specify details on services meeting these security needs.

NOTE            Security requirements for EHR systems not related to the communication of EHRs are outside the scope of this document.