ISO 27789:2021 健康情報学—電子健康記録の監査証跡 | ページ 6

3.1

access control

means to ensure that access to assets is authorized and restricted based on business and security requirements

[SOURCE:ISO/IEC 27000:2018, 3.1]

3.2

access policy

definition of the obligations for authorizing access to a resource

3.3

accountability

obligation of an individual or organization to account for its activities, for completion of a deliverable or task, accept responsibility for those activities, deliverables or tasks, and to disclose the results in a transparent manner

[SOURCE:ISO/TS 21089:2018, 3.3.1]

3.4

agent

entity that takes programmed actions, such as software or a device

[SOURCE:ISO/TS 21089:2018, 3.6.4]

3.5

alert

what is sent when the monitor service notices that a series of events matches a pattern

3.6

audit

independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures, and to recommend necessary changes in controls, policies or procedures

[SOURCE:ISO/TS 21089:2018, 3.20]

3.7

audit archive

archival collection of one or more audit logs

3.8

audit data

data obtained from one or more audit records

3.9

audit log

chronological sequence of audit records, each of which contains data about a specific event

3.10

audit record

record of a single specific event in the life cycle of an electronic health record

3.11

audit system

information processing system that maintains one or more audit logs

3.12

audit trail

chronological record of system activities that is sufficient to enable the reconstruction, reviewing and examination of the sequence of environments and activities surrounding or leading to an operation, a procedure, or an event in a transaction from its inception to final results

[SOURCE:GCST]

3.13

authentication

provision of assurance that a claimed characteristic of an entity is correct

[SOURCE:ISO/IEC 27000:2018, 3.5]

3.14

authorization

granting of rights, which includes the granting of access based on access rights

[SOURCE:ISO/IEC 2382:2015, 2126256, modified — Notes to entry deleted.]

3.15

availability

property of being accessible and useable upon demand by an authorized entity

[SOURCE:ISO/IEC 27000:2018, 3.7]

3.16

confidentiality

property that information is not made available or disclosed to unauthorized individuals, entities, or processes

[SOURCE:ISO/IEC 27000:2018, 3.10]

3.17

coordinated universal time

UTC

time scale which forms the basis of a coordinated radio dissemination of standard frequencies and time signals

Note 1 to entry: UTC corresponds exactly in rate with international atomic time, but differs from it by an integral number of seconds.

[SOURCE:IEC 60050‑713:1998, 05-20]

3.18

data integrity

property of data whose accuracy and consistency are preserved regardless of changes made

[SOURCE:ISO 2382:2015, 2126247, modified — Notes to entry deleted.]

3.19

electronic health record

EHR

repository of (organized sets of) information regarding the health status of a subject of care, in computer processable form

[SOURCE:ISO/TR 20514:2005, 2.11, modified — Text in parenthesis added.]

3.20

electronic health record segment

EHR segment

part of an electronic health record that constitutes a distinct resource for the access policy

3.21

identification

process of recognizing the attributes that identify the object

[SOURCE:ISO 16678:2014, 2.1.7]

3.22

identifier

one or more characters used to identify or name a data element and possibly to indicate certain properties of that data element

[SOURCE:ISO/IEC 2382:2015, 2121623]

3.23

information security

preservation of confidentiality, integrity and availability of information

[SOURCE:ISO/IEC 27000:2018, 3.28]

3.24

integrity

property of accuracy and completeness

[SOURCE:ISO/IEC 27000:2018, 3.36]

3.25

object identifier

OID

globally unique identifier for an information object

Note 1 to entry: The object identifiers used in this document refer to code systems. These code systems can be defined in a standard or locally defined per implementation. The object identifier is specified using the Abstract Syntax Notation One (ASN.1) defined in ISO/IEC 8824-1 and ISO/IEC 8824-2.

3.26

policy

set of rules related to a particular purpose

Note 1 to entry: A rule can be expressed as an obligation, an authorization, a permission or a prohibition.

[SOURCE:ISO 19101-2:2018, modified — Note 1 to entry added]

3.27

privilege

capacity assigned to an entity by an authority

3.28

records management

field of management responsible for control of creation, receipt, maintenance, use and disposition of records, including processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records

[SOURCE:ISO 15489‑1:2016, 3.15, modified]

3.29

role

set of competences and/or performances associated with a task

3.30

security policy

plan or course of action adopted for providing computer security

[SOURCE:ISO/IEC 2382:2015, 2126246, modified — Notes to entry deleted.]

3.31

sensitivity

measure of the potential or perceived potential to abuse or misuse data about subjects or to harm them

3.32

subject of care

person or defined groups of persons receiving or registered as eligible to receive healthcare services or having received healthcare services

Note 1 to entry: For example, a patient, client, customer, or health plan member.

[SOURCE:ISO/TS 17975:2015, modified — Note to entry added.]

3.33

user

person or other entity authorized by a provider to use some or all of the services provided by the provider

Note 1 to entry: Also, human being using the system to issue requests to objects in order to get them to perform functions in the system on his/her behalf.

[SOURCE:COACH; OMG]