The potential areas of application of PKI (Public Key Infrastructure) in health are numerous, and the South-East health region has examined the need for introducing PKI. A detailed specification of requirements for PKI in the public sector has been prepared that sets specific requirements for different security levels. In turn, these levels are linked to various services.
An implementation of PKI in the South-East Health Region will be a prerequisite for adopting some key service areas that are planned to be introduced in the next few years such as eResept [‘ePrescriptions’], eSykemelding [‘eSickNote’] and Nasjonal kjernejournal (KJ) [National Core Medical Charts]. Simultaneously, PKI should facilitate a variety of other services that will enhance both security and usability of the overall range of services.
Ahus introduced PKI when occupying its new hospital in 2008, and local certificates are in use today, including logging on to IT systems. The certificates take the form of a shared card solution from Buypass which additionally contains, among other things, physical identification, magnetic stripe payment in the canteen and RFID for physical access control. No other company in the region has currently introduced PKI.
The overall objectives of the introduction are, in order of priority:
— To ensure a fast and cost-effective introduction of PKI to prevent delay in the introduction of the above-mentioned essential services
— To ensure that this work is of such quality that it becomes a building block for a more comprehensive PKI solution so that other services can be developed and improved
The following conditions have been established for the introduction:
— The South-East Health Region has an established PKI infrastructure with CA, CRL/OCSP under Norwegian Health Network's umbrella as part of the standard platform for the management of local certificates. This should therefore not be a part of the delivery.
— The certificates shall be issued by the South-East Health Region. The supplier must therefore be able to offer LRA.
— The solutions implemented must be adapted to all platforms in the South-East Health Region.
The work is divided into 2 phases:
Phase 1 — eResept: This phase will aim to facilitate the signing of an eResept. The following provisions have been added:
— All doctors who shall sign an eResept must have a personally qualified certificate.
— All PCs in clinical use by docotrs must have the necessary set-up.
— PKI must work with DIPS version 7.1.5. or newer.
— The solution must be compatible with the prescription provider and the other participants in the eResept chain.
As this facilitates document signing by doctors, the solution must also be compatible with eSykemelding when that solution is introduced.
Phase 1 will include 8 of the 10 health companies in the South-East Health Region, i.e. not Ahus and Hospital Pharmacies.
Phase 2 — Development of PKI: In Phase 2, the existing infrastructure should be able to be developed, scaled up and applied to new services. This will include the National Core Medical Records, a service that requires PKI authentication. Other services the PKI facilitates include login, Follow-me printing, additional document signing, cross access, VPN etc. At Ahus, the certificate bearer also has physical access control, clothing retrieval, canteen payments, etc.
In this phase, it may be appropriate to include other health companies and foundations.
eResept [i.e. ePrescription]
E-resept is an important contribution for achieving the goals of increased patient safety through safer medication use. The solution is an electronic interaction chain for secure transmission of prescription information. E-prescription reduces the risk of errors in prescribing and dispensing of medicines. Every year, medication errors result in injuries and deaths. Research suggests that the extent of this is very high. eResept is one of several national initiatives to reduce this.
The South-East Health Region has sent a letter to the Norwegian Ministry of Health and Care Services on 17.12.2012 that submits a binding plan for the introduction of eResept in all hospital trusts in the region. Aims of the introduction are:
— to introduce eResept in all hospital trusts in the South-East Health Region by the end of 2015,
— eResept will help reduce injuries and deaths due to medication errors.
For further details refer to the Norwegian Directorate of Health Benefit's Plan for eResept.
Section V: Award of contract
Contract No: 1
Lot No: 1 - Lot title: PKI solution for the South-East Health Region
V.1) Date of contract award decision:
30.10.2014
V.2) Information about offers
Number of offers received: 2
V.3) Name and address of economic operator in favour of whom the contract award decision has been taken
Commfides Norge AS988312495, Fornebuveien 1, 1366 Lysaker, NORWAY