HL7.TERMINOLOGY\SecurityObservationValue

This page is part of the HL7 Terminology (v1.0.0: Release) based on FHIR R4. The current version which supercedes this version is 5.2.0. For a full list of available versions, see the Directory of published versions

SecurityObservationValue

Summary

Defining URL:

http://terminology.hl7.org/ValueSet/v3-SecurityObservationValue

Version:

2.0.0

Name:

SecurityObservationValue

Status:

Active

Title:

SecurityObservationValue

Definition:

Observation values used to indicate security observation metadata.

OID:

2.16.840.1.113883.1.11.20469 (for OID based terminology systems)

Source Resource:

XML / JSON / Turtle

References

This value set is not used

Content Logical Definition

Logical Definition (CLD)

This value set includes codes based on the following rules:

Include codes from http://terminology.hl7.org/CodeSystem/v3-ObservationValue where concept is-a _SecurityObservationValue
Import all the codes that are contained in http://terminology.hl7.org/ValueSet/v3-SecurityClassificationObservationValue

Expansion

This value set contains 76 concepts

Expansion based on:

Code	System	Display	Definition
_SecurityObservationValue	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	SecurityObservationValue	Observation values used to indicate security observation metadata.
_SECCATOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	security category	Abstract security observation values used to indicate security category metadata. Examples: Codes conveying: * privacy law * information sensitivity * consent directive types
_SECCLASSOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	security classification	Abstract security observation values used to indicate security classification metadata. Examples: Confidentiality Codes
_SECCONOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	security control	Abstract security observation values used to indicate security control metadata. Examples: Codes conveying dissemination controls, information handling caveats, purpose of use, refrain policies, and obligations to which custodians and information receivers must comply.
_SECINTOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	security integrity	Abstract security observation values used to indicate security integrity metadata. Examples: Codes conveying integrity status, integrity confidence, and provenance.
_SECALTINTOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	alteration integrity	Abstract security metadata observation values used to indicate mechanism used for authorized alteration of an IT resource (data, information object, service, or system capability)
ABSTRED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	abstracted	Security metadata observation values used to indicate the use of a more abstract version of the content, e.g., replacing exact value of an age or date field with a range, or remove the left digits of a credit card number or SSN.
AGGRED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	aggregated	Security metadata observation values used to indicate the use of an algorithmic combination of actual values with the result of an aggregate function, e.g., average, sum, or count in order to limit disclosure of an IT resource (data, information object, service, or system capability) to the minimum necessary.
ANONYED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	anonymized	Security metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability) by used to indicate the mechanism by which software systems can strip portions of the resource that could allow the identification of the source of the information or the information subject. No key to relink the data is retained.
MAPPED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	mapped	Security metadata observation value used to indicate that the IT resource semantic content has been transformed from one encoding to another. Usage Note: "MAP" code does not indicate the semantic fidelity of the transformed content. To indicate semantic fidelity for maps of HL7 to other code systems, this security alteration integrity observation may be further specified using an Act valued with Value Set: MapRelationship (2.16.840.1.113883.1.11.11052). Semantic fidelity of the mapped IT Resource may also be indicated using a SecurityIntegrityConfidenceObservation.
MASKED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	masked	Security metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability) by indicating the mechanism by which software systems can make data unintelligible (that is, as unreadable and unusable by algorithmically transforming plaintext into ciphertext) such that it can only be accessed or used by authorized users. An authorized user may be provided a key to decrypt per license or "shared secret". Usage Note: "MASKED" may be used, per applicable policy, as a flag to indicate to a user or receiver that some portion of an IT resource has been further encrypted, and may be accessed only by an authorized user or receiver to which a decryption key is provided.
PSEUDED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	pseudonymized	Security metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability), by indicating the mechanism by which software systems can strip portions of the resource that could allow the identification of the source of the information or the information subject. Custodian may retain a key to relink data necessary to reidentify the information subject. Rationale: Personal data which has been processed to make it impossible to know whose data it is. Used particularly for secondary use of health data. In some cases, it may be possible for authorized individuals to restore the identity of the individual, e.g.,for public health case management. Based on ISO/TS 25237:2008 Health informaticsâ€”Pseudonymization
REDACTED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	redacted	Security metadata observation value used to indicate the mechanism by which software systems can filter an IT resource (data, information object, service, or system capability) to remove any portion of the resource that is not authorized to be access, used, or disclosed. Usage Note: "REDACTED" may be used, per applicable policy, as a flag to indicate to a user or receiver that some portion of an IT resource has filtered and not included in the content accessed or received.
SUBSETTED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	subsetted	Metadata observation used to indicate that some information has been removed from the source object when the view this object contains was constructed because of configuration options when the view was created. The content may not be suitable for use as the basis of a record update Usage Note: This is not suitable to be used when information is removed for security reasons - see the code REDACTED for this use.
SYNTAC	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	syntactic transform	Security metadata observation value used to indicate that the IT resource syntax has been transformed from one syntactical representation to another. Usage Note: "SYNTAC" code does not indicate the syntactical correctness of the syntactically transformed IT resource.
TRSLT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	translated	Security metadata observation value used to indicate that the IT resource has been translated from one human language to another. Usage Note: "TRSLT" does not indicate the fidelity of the translation or the languages translated. The fidelity of the IT Resource translation may be indicated using a SecurityIntegrityConfidenceObservation. To indicate languages, use the Value Set:HumanLanguage (2.16.840.1.113883.1.11.11526)
VERSIONED	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	versioned	Security metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability) which indicates that the resource only retains versions of an IT resource for access and use per applicable policy Usage Note: When this code is used, expectation is that the system has removed historical versions of the data that falls outside the time period deemed to be the effective time of the applicable version.
_SECDATINTOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	data integrity	Abstract security observation values used to indicate data integrity metadata. Examples: Codes conveying the mechanism used to preserve the accuracy and consistency of an IT resource such as a digital signature and a cryptographic hash function.
CRYTOHASH	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	cryptographic hash function	Security metadata observation value used to indicate the mechanism by which software systems can establish that data was not modified in transit. Rationale: This definition is intended to align with the ISO 22600-2 3.3.19 definition of cryptographic checkvalue: Information which is derived by performing a cryptographic transformation (see cryptography) on the data unit. The derivation of the checkvalue may be performed in one or more steps and is a result of a mathematical function of the key and a data unit. It is usually used to check the integrity of a data unit. Examples: * SHA-1 * SHA-2 (Secure Hash Algorithm)
DIGSIG	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	digital signature	Security metadata observation value used to indicate the mechanism by which software systems use digital signature to establish that data has not been modified. Rationale: This definition is intended to align with the ISO 22600-2 3.3.26 definition of digital signature: Data appended to, or a cryptographic transformation (see cryptography) of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery e.g., by the recipient.
_SECINTCONOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	integrity confidence	Abstract security observation value used to indicate integrity confidence metadata. Examples: Codes conveying the level of reliability and trustworthiness of an IT resource.
HRELIABLE	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	highly reliable	Security metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be very high.
RELIABLE	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	reliable	Security metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be adequate.
UNCERTREL	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	uncertain reliability	Security metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be uncertain.
UNRELIABLE	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	unreliable	Security metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be inadequate.
_SECINTPRVOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	provenance	Abstract security metadata observation value used to indicate the provenance of an IT resource (data, information object, service, or system capability). Examples: Codes conveying the provenance metadata about the entity reporting an IT resource.
_SECINTPRVABOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	provenance asserted by	Abstract security provenance metadata observation value used to indicate the entity that asserted an IT resource (data, information object, service, or system capability). Examples: Codes conveying the provenance metadata about the entity asserting the resource.
CLINAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	clinician asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a clinician.
DEVAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	device asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a device.
HCPAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	healthcare professional asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a healthcare professional.
PACQAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	patient acquaintance asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a patient acquaintance.
PATAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	patient asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a patient.
PAYAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	payer asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a payer.
PROAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	professional asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a professional.
SDMAST	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	substitute decision maker asserted	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a substitute decision maker.
_SECINTPRVRBOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	provenance reported by	Abstract security provenance metadata observation value used to indicate the entity that reported the resource (data, information object, service, or system capability). Examples: Codes conveying the provenance metadata about the entity reporting an IT resource.
CLINRPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	clinician reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a clinician.
DEVRPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	device reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a device.
HCPRPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	healthcare professional reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a healthcare professional.
PACQRPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	patient acquaintance reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a patient acquaintance.
PATRPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	patient reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a patient.
PAYRPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	payer reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a payer.
PRORPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	professional reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a professional.
SDMRPT	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	substitute decision maker reported	Security provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a substitute decision maker.
_SECINTSTOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	integrity status	Abstract security observation values used to indicate integrity status metadata. Examples: Codes, such as those in the HL7 DocumentClassification code system conveying the workflow status of resource as authenticated, legally authenticated, and in progress.
SECTRSTOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	security trust observation	Observation value used to indicate aspects of trust applicable to an IT resource (data, information object, service, or system capability).
TRSTACCRDOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	trust accreditation observation	Values for security trust accreditation metadata observation made about the formal declaration by an authority or neutral third party that validates the technical, security, trust, and business practice conformance of Trust Agents to facilitate security, interoperability, and trust among participants within a security domain or trust framework.
TRSTAGREOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	trust agreement observation	Values for security trust agreement metadata observation made about privacy and security requirements with which a security domain must comply. \[ISO IEC 10181-1\] \[ISO IEC 10181-1\]
TRSTCERTOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	trust certificate observation	Values for security trust certificate metadata observation made about a set of security-relevant data issued by a security authority or trusted third party, together with security information which is used to provide the integrity and data origin authentication services for an IT resource (data, information object, service, or system capability). \[Based on ISO IEC 10181-1\] For example, a Certificate Policy (CP), which is a named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements. A particular Certificate Policy might indicate the applicability of a type of certificate to the authentication of electronic data interchange transactions for the trading of goods within a given price range. Another example is Cross Certification with Federal Bridge.
TRSTFWKOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	none supplied 5	Values for security trust framework metadata observation made about a complete set of contracts, regulations or commitments that enable participating actors to rely on certain assertions by other actors to fulfill their information security requirements. \[Kantara Initiative\]
TRSTLOAOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	trust assurance observation	Values for security trust assurance metadata observation made about the digital quality or reliability of a trust assertion, activity, capability, information exchange, mechanism, process, or protocol.
LOAAN	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	authentication level of assurance value	The value assigned as the indicator of the digital quality or reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] For example, the degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\]
LOAAN1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low authentication level of assurance	Indicator of low digital quality or reliability of the digital reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] Low authentication level of assurance indicates that the relying party may have little or no confidence in the asserted identity's validity. Level 1 requires little or no confidence in the asserted identity. No identity proofing is required at this level, but the authentication mechanism should provide some assurance that the same claimant is accessing the protected transaction or data. A wide range of available authentication technologies can be employed and any of the token methods of Levels 2, 3, or 4, including Personal Identification Numbers (PINs), may be used. To be authenticated, the claimant must prove control of the token through a secure authentication protocol. At Level 1, long-term shared authentication secrets may be revealed to verifiers. Assertions issued about claimants as a result of a successful authentication are either cryptographically authenticated by relying parties (using approved methods) or are obtained directly from a trusted party via a secure authentication protocol. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAN2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic authentication level of assurance	Indicator of basic digital quality or reliability of the digital reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] Basic authentication level of assurance indicates that the relying party may have some confidence in the asserted identity's validity. Level 2 requires confidence that the asserted identity is accurate. Level 2 provides for single-factor remote network authentication, including identity-proofing requirements for presentation of identifying materials or information. A wide range of available authentication technologies can be employed, including any of the token methods of Levels 3 or 4, as well as passwords. Successful authentication requires that the claimant prove through a secure authentication protocol that the claimant controls the token. Eavesdropper, replay, and online guessing attacks are prevented. Long-term shared authentication secrets, if used, are never revealed to any party except the claimant and verifiers operated by the CSP; however, session (temporary) shared secrets may be provided to independent verifiers by the CSP. Approved cryptographic techniques are required. Assertions issued about claimants as a result of a successful authentication are either cryptographically authenticated by relying parties (using approved methods) or are obtained directly from a trusted party via a secure authentication protocol. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAN3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium authentication level of assurance	Indicator of medium digital quality or reliability of the digital reliability of verification and validation of the process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] Medium authentication level of assurance indicates that the relying party may have high confidence in the asserted identity's validity. Level 3 is appropriate for transactions that need high confidence in the accuracy of the asserted identity. Level 3 provides multifactor remote network authentication. At this level, identity-proofing procedures require verification of identifying materials and information. Authentication is based on proof of possession of a key or password through a cryptographic protocol. Cryptographic strength mechanisms should protect the primary authentication token (a cryptographic key) against compromise by the protocol threats, including eavesdropper, replay, online guessing, verifier impersonation, and man-in-the-middle attacks. A minimum of two authentication factors is required. Three kinds of tokens may be used: * "soft" cryptographic token, which has the key stored on a general-purpose computer, * "hard" cryptographic token, which has the key stored on a special hardware device, and * "one-time password" device token, which has symmetric key stored on a personal hardware device that is a cryptographic module validated at FIPS 140-2 Level 1 or higher. Validation testing of cryptographic modules and algorithms for conformance to Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Modules, is managed by NIST. Authentication requires that the claimant prove control of the token through a secure authentication protocol. The token must be unlocked with a password or biometric representation, or a password must be used in a secure authentication protocol, to establish two-factor authentication. Long-term shared authentication secrets, if used, are never revealed to any party except the claimant and verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent verifiers by the CSP. Approved cryptographic techniques are used for all operations. Assertions issued about claimants as a result of a successful authentication are either cryptographically authenticated by relying parties (using approved methods) or are obtained directly from a trusted party via a secure authentication protocol. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAN4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high authentication level of assurance	Indicator of high digital quality or reliability of the digital reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] High authentication level of assurance indicates that the relying party may have very high confidence in the asserted identity's validity. Level 4 is for transactions that need very high confidence in the accuracy of the asserted identity. Level 4 provides the highest practical assurance of remote network authentication. Authentication is based on proof of possession of a key through a cryptographic protocol. This level is similar to Level 3 except that only â€œhardâ€? cryptographic tokens are allowed, cryptographic module validation requirements are strengthened, and subsequent critical data transfers must be authenticated via a key that is bound to the authentication process. The token should be a hardware cryptographic module validated at FIPS 140-2 Level 2 or higher overall with at least FIPS 140-2 Level 3 physical security. This level requires a physical token, which cannot readily be copied, and operator authentication at Level 2 and higher, and ensures good, two-factor remote authentication. Level 4 requires strong cryptographic authentication of all parties and all sensitive data transfers between the parties. Either public key or symmetric key technology may be used. Authentication requires that the claimant prove through a secure authentication protocol that the claimant controls the token. Eavesdropper, replay, online guessing, verifier impersonation, and man-in-the-middle attacks are prevented. Long-term shared authentication secrets, if used, are never revealed to any party except the claimant and verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent verifiers by the CSP. Strong approved cryptographic techniques are used for all operations. All sensitive data transfers are cryptographically authenticated using keys bound to the authentication process. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAP	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	authentication process level of assurance value	The value assigned as the indicator of the digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\]
LOAAP1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low authentication process level of assurance	Indicator of the low digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] Low authentication process level of assurance indicates that (1) long-term shared authentication secrets may be revealed to verifiers; and (2) assertions and assertion references require protection from manufacture/modification and reuse attacks. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAP2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic authentication process level of assurance	Indicator of the basic digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] Basic authentication process level of assurance indicates that long-term shared authentication secrets are never revealed to any other party except Credential Service Provider (CSP). Sessions (temporary) shared secrets may be provided to independent verifiers by CSP. Long-term shared authentication secrets, if used, are never revealed to any other party except Verifiers operated by the Credential Service Provider (CSP); however, session (temporary) shared secrets may be provided to independent Verifiers by the CSP. In addition to Level 1 requirements, assertions are resistant to disclosure, redirection, capture and substitution attacks. Approved cryptographic techniques are required. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAP3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium authentication process level of assurance	Indicator of the medium digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] Medium authentication process level of assurance indicates that the token can be unlocked with password, biometric, or uses a secure multi-token authentication protocol to establish two-factor authentication. Long-term shared authentication secrets are never revealed to any party except the Claimant and Credential Service Provider (CSP). Authentication requires that the Claimant prove, through a secure authentication protocol, that he or she controls the token. The Claimant unlocks the token with a password or biometric, or uses a secure multi-token authentication protocol to establish two-factor authentication (through proof of possession of a physical or software token in combination with some memorized secret knowledge). Long-term shared authentication secrets, if used, are never revealed to any party except the Claimant and Verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent Verifiers by the CSP. In addition to Level 2 requirements, assertions are protected against repudiation by the Verifier.
LOAAP4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high authentication process level of assurance	Indicator of the high digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] High authentication process level of assurance indicates all sensitive data transfer are cryptographically authenticated using keys bound to the authentication process. Level 4 requires strong cryptographic authentication of all communicating parties and all sensitive data transfers between the parties. Either public key or symmetric key technology may be used. Authentication requires that the Claimant prove through a secure authentication protocol that he or she controls the token. All protocol threats at Level 3 are required to be prevented at Level 4. Protocols shall also be strongly resistant to man-in-the-middle attacks. Long-term shared authentication secrets, if used, are never revealed to any party except the Claimant and Verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent Verifiers by the CSP. Approved cryptographic techniques are used for all operations. All sensitive data transfers are cryptographically authenticated using keys bound to the authentication process. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAS	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	assertion level of assurance value	The value assigned as the indicator of the high quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes.
LOAAS1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low assertion level of assurance	Indicator of the low quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Assertions and assertion references require protection from modification and reuse attacks. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAS2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic assertion level of assurance	Indicator of the basic quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Assertions are resistant to disclosure, redirection, capture and substitution attacks. Approved cryptographic techniques are required for all assertion protocols. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAS3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium assertion level of assurance	Indicator of the medium quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Assertions are protected against repudiation by the verifier. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAS4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high assertion level of assurance	Indicator of the high quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Strongly resistant to man-in-the-middle attacks. "Bearer" assertions are not used. "Holder-of-key" assertions may be used. RP maintains records of the assertions. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOACM	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	token and credential management level of assurance value)	Indicator of the digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and its binding to an identity. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low token and credential management level of assurance	Indicator of the low digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and its binding to an identity. Little or no confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include weak identity binding to tokens and plaintext passwords or secrets not transmitted across a network. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic token and credential management level of assurance	Indicator of the basic digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and its binding to an identity. Some confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include: Verification must prove claimant controls the token; token resists online guessing, replay, session hijacking, and eavesdropping attacks; and token is at least weakly resistant to man-in-the middle attacks. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium token and credential management level of assurance	Indicator of the medium digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and itâ€™s binding to an identity. High confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include: Ownership of token verifiable through security authentication protocol and credential management protects against verifier impersonation attacks. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high token and credential management level of assurance	Indicator of the high digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and itâ€™s binding to an identity. Very high confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include: Verifier can prove control of token through a secure protocol; credential management supports strong cryptographic authentication of all communication parties. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAID	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	identity proofing level of assurance	Indicator of the quality or reliability in the process of ascertaining that an individual is who he or she claims to be.
LOAID1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low identity proofing level of assurance	Indicator of low digital quality or reliability in the process of ascertaining that an individual is who he or she claims to be. Requires that a continuity of identity be maintained but does not require identity proofing. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAID2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic identity proofing level of assurance	Indicator of some digital quality or reliability in the process of ascertaining that that an individual is who he or she claims to be. Requires identity proofing via presentation of identifying material or information. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAID3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium identity proofing level of assurance	Indicator of high digital quality or reliability in the process of ascertaining that an individual is who he or she claims to be. Requires identity proofing procedures for verification of identifying materials and information. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAID4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high identity proofing level of assurance	Indicator of high digital quality or reliability in the process of ascertaining that an individual is who he or she claims to be. Requires identity proofing procedures for verification of identifying materials and information. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOANR	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	non-repudiation level of assurance value	Indicator of the digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low non-repudiation level of assurance	Indicator of low digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic non-repudiation level of assurance	Indicator of basic digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium non-repudiation level of assurance	Indicator of medium digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high non-repudiation level of assurance	Indicator of high digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOARA	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	remote access level of assurance value	Indicator of the digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organizationâ€™s security controls. \[Based on NIST SP 800-63-2\]
LOARA1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low remote access level of assurance	Indicator of low digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organizationâ€™s security controls. \[Based on NIST SP 800-63-2\]
LOARA2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic remote access level of assurance	Indicator of basic digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organizationâ€™s security controls. \[Based on NIST SP 800-63-2\]
LOARA3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium remote access level of assurance	Indicator of medium digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organizationâ€™s security controls. \[Based on NIST SP 800-63-2\]
LOARA4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high remote access level of assurance	Indicator of high digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organization's security controls. \[Based on NIST SP 800-63-2\]
LOATK	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	token level of assurance value	Indicator of the digital quality or reliability of single and multi-token authentication. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK1	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	low token level of assurance	Indicator of the low digital quality or reliability of single and multi-token authentication. Permits the use of any of the token methods of Levels 2, 3, or 4. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK2	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	basic token level of assurance	Indicator of the basic digital quality or reliability of single and multi-token authentication. Requires single factor authentication using memorized secret tokens, pre-registered knowledge tokens, look-up secret tokens, out of band tokens, or single factor one-time password devices. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK3	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	medium token level of assurance	Indicator of the medium digital quality or reliability of single and multi-token authentication. Requires two authentication factors. Provides multi-factor remote network authentication. Permits multi-factor software cryptographic token. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK4	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	high token level of assurance	Indicator of the high digital quality or reliability of single and multi-token authentication. Requires token that is a hardware cryptographic module validated at validated at Federal Information Processing Standard (FIPS) 140-2 Level 2 or higher overall with at least FIPS 140-2 Level 3 physical security. Level 4 token requirements can be met by using the PIV authentication key of a FIPS 201 compliant Personal Identity Verification (PIV) Card. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
TRSTMECOBV	http://terminology.hl7.org/CodeSystem/v3-ObservationValue	none supplied 6	Values for security trust mechanism metadata observation made about a security architecture system component that supports enforcement of security policies.
L	http://terminology.hl7.org/CodeSystem/v3-Confidentiality	low	Definition: Privacy metadata indicating that the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity. Examples: Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets. Map: No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD\_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services. Usage Note: This metadata indicates the receiver may have an obligation to comply with a data use agreement.
M	http://terminology.hl7.org/CodeSystem/v3-Confidentiality	moderate	Definition: Privacy metadata indicating moderately sensitive information, which presents moderate risk of harm if disclosed without authorization. Examples: Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws. Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD\_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff). Usage Note: This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies.
N	http://terminology.hl7.org/CodeSystem/v3-Confidentiality	normal	Definition: Privacy metadata indicating that the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization. Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance. Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations. Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization.
R	http://terminology.hl7.org/CodeSystem/v3-Confidentiality	restricted	Privacy metadata indicating highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be pre-empted by jurisdictional law, e.g., for public health reporting or emergency treatment. Examples: Includes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patient's standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual, e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer. Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations.. Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization..
U	http://terminology.hl7.org/CodeSystem/v3-Confidentiality	unrestricted	Definition: Privacy metadata indicating that the information is not classified as sensitive. Examples: Includes publicly available information, e.g., business name, phone, email or physical address. Usage Note: This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestricted" to that information even if it is publicly available.
V	http://terminology.hl7.org/CodeSystem/v3-Confidentiality	very restricted	. Privacy metadata indicating that the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence. Examples: Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under â€œlegal lockâ€? or attorney-client privilege Map: This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject. Usage Note: This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject.
_Confidentiality	http://terminology.hl7.org/CodeSystem/v3-Confidentiality	Confidentiality	A specializable code and its leaf codes used in Confidentiality value sets to value the Act.Confidentiality and Role.Confidentiality attribute in accordance with the definition for concept domain "Confidentiality".

Explanation of the columns that may appear on this page:

Level

A few code lists that FHIR defines are hierarchical - each code is assigned a level. In this scheme, some codes are under other codes, and imply that the code they are under also applies

Source

The source of the definition of the code (when the value set draws in codes defined elsewhere)

Code

The code (used as the code in the resource instance)

Display

The display (used in the display element of a Coding). If there is no display, implementers should not simply display the code, but map the concept into their application

Definition

An explanation of the meaning of the concept

Comments

Additional notes about how to use the code

History

Date

Action

Author

Custodian

Comment

2020-05-06

revise