HL7 Terminology
1.0.0 - Publication

This page is part of the HL7 Terminology (v1.0.0: Release) based on FHIR R4. This is the current published version. For a full list of available versions, see the Directory of published versions

SecurityObservationValue

Summary

Defining URL:http://terminology.hl7.org/ValueSet/v3-SecurityObservationValue
Version:2.0.0
Name:SecurityObservationValue
Status:Active
Title:SecurityObservationValue
Definition:

Observation values used to indicate security observation metadata.

OID:2.16.840.1.113883.1.11.20469 (for OID based terminology systems)
Source Resource:XML / JSON / Turtle

References

This value set is not used

Content Logical Definition

Logical Definition (CLD)

This value set includes codes based on the following rules:

 

Expansion

This value set contains 76 concepts

CodeSystemDisplayDefinition
_SecurityObservationValuehttp://terminology.hl7.org/CodeSystem/v3-ObservationValueSecurityObservationValueObservation values used to indicate security observation metadata.
_SECCATOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesecurity categoryAbstract security observation values used to indicate security category metadata. **Examples:** Codes conveying: * privacy law * information sensitivity * consent directive types
_SECCLASSOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesecurity classificationAbstract security observation values used to indicate security classification metadata. **Examples:** Confidentiality Codes
_SECCONOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesecurity controlAbstract security observation values used to indicate security control metadata. **Examples:** Codes conveying dissemination controls, information handling caveats, purpose of use, refrain policies, and obligations to which custodians and information receivers must comply.
_SECINTOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesecurity integrityAbstract security observation values used to indicate security integrity metadata. **Examples:** Codes conveying integrity status, integrity confidence, and provenance.
_SECALTINTOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuealteration integrityAbstract security metadata observation values used to indicate mechanism used for authorized alteration of an IT resource (data, information object, service, or system capability)
ABSTREDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueabstractedSecurity metadata observation values used to indicate the use of a more abstract version of the content, e.g., replacing exact value of an age or date field with a range, or remove the left digits of a credit card number or SSN.
AGGREDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueaggregatedSecurity metadata observation values used to indicate the use of an algorithmic combination of actual values with the result of an aggregate function, e.g., average, sum, or count in order to limit disclosure of an IT resource (data, information object, service, or system capability) to the minimum necessary.
ANONYEDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueanonymizedSecurity metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability) by used to indicate the mechanism by which software systems can strip portions of the resource that could allow the identification of the source of the information or the information subject. No key to relink the data is retained.
MAPPEDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuemappedSecurity metadata observation value used to indicate that the IT resource semantic content has been transformed from one encoding to another. *Usage Note:* "MAP" code does not indicate the semantic fidelity of the transformed content. To indicate semantic fidelity for maps of HL7 to other code systems, this security alteration integrity observation may be further specified using an Act valued with Value Set: MapRelationship (2.16.840.1.113883.1.11.11052). Semantic fidelity of the mapped IT Resource may also be indicated using a SecurityIntegrityConfidenceObservation.
MASKEDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuemaskedSecurity metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability) by indicating the mechanism by which software systems can make data unintelligible (that is, as unreadable and unusable by algorithmically transforming plaintext into ciphertext) such that it can only be accessed or used by authorized users. An authorized user may be provided a key to decrypt per license or "shared secret". *Usage Note:* "MASKED" may be used, per applicable policy, as a flag to indicate to a user or receiver that some portion of an IT resource has been further encrypted, and may be accessed only by an authorized user or receiver to which a decryption key is provided.
PSEUDEDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuepseudonymizedSecurity metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability), by indicating the mechanism by which software systems can strip portions of the resource that could allow the identification of the source of the information or the information subject. Custodian may retain a key to relink data necessary to reidentify the information subject. *Rationale:* Personal data which has been processed to make it impossible to know whose data it is. Used particularly for secondary use of health data. In some cases, it may be possible for authorized individuals to restore the identity of the individual, e.g.,for public health case management. Based on ISO/TS 25237:2008 Health informatics—Pseudonymization
REDACTEDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueredactedSecurity metadata observation value used to indicate the mechanism by which software systems can filter an IT resource (data, information object, service, or system capability) to remove any portion of the resource that is not authorized to be access, used, or disclosed. *Usage Note:* "REDACTED" may be used, per applicable policy, as a flag to indicate to a user or receiver that some portion of an IT resource has filtered and not included in the content accessed or received.
SUBSETTEDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesubsettedMetadata observation used to indicate that some information has been removed from the source object when the view this object contains was constructed because of configuration options when the view was created. The content may not be suitable for use as the basis of a record update *Usage Note:* This is not suitable to be used when information is removed for security reasons - see the code REDACTED for this use.
SYNTAChttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesyntactic transformSecurity metadata observation value used to indicate that the IT resource syntax has been transformed from one syntactical representation to another. *Usage Note:* "SYNTAC" code does not indicate the syntactical correctness of the syntactically transformed IT resource.
TRSLThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuetranslatedSecurity metadata observation value used to indicate that the IT resource has been translated from one human language to another. *Usage Note:* "TRSLT" does not indicate the fidelity of the translation or the languages translated. The fidelity of the IT Resource translation may be indicated using a SecurityIntegrityConfidenceObservation. To indicate languages, use the Value Set:HumanLanguage (2.16.840.1.113883.1.11.11526)
VERSIONEDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueversionedSecurity metadata observation value conveying the alteration integrity of an IT resource (data, information object, service, or system capability) which indicates that the resource only retains versions of an IT resource for access and use per applicable policy *Usage Note:* When this code is used, expectation is that the system has removed historical versions of the data that falls outside the time period deemed to be the effective time of the applicable version.
_SECDATINTOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuedata integrityAbstract security observation values used to indicate data integrity metadata. **Examples:** Codes conveying the mechanism used to preserve the accuracy and consistency of an IT resource such as a digital signature and a cryptographic hash function.
CRYTOHASHhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuecryptographic hash functionSecurity metadata observation value used to indicate the mechanism by which software systems can establish that data was not modified in transit. *Rationale:* This definition is intended to align with the ISO 22600-2 3.3.19 definition of cryptographic checkvalue: Information which is derived by performing a cryptographic transformation (see cryptography) on the data unit. The derivation of the checkvalue may be performed in one or more steps and is a result of a mathematical function of the key and a data unit. It is usually used to check the integrity of a data unit. **Examples:** * SHA-1 * SHA-2 (Secure Hash Algorithm)
DIGSIGhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuedigital signatureSecurity metadata observation value used to indicate the mechanism by which software systems use digital signature to establish that data has not been modified. *Rationale:* This definition is intended to align with the ISO 22600-2 3.3.26 definition of digital signature: Data appended to, or a cryptographic transformation (see cryptography) of, a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery e.g., by the recipient.
_SECINTCONOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueintegrity confidenceAbstract security observation value used to indicate integrity confidence metadata. **Examples:** Codes conveying the level of reliability and trustworthiness of an IT resource.
HRELIABLEhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuehighly reliableSecurity metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be very high.
RELIABLEhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuereliableSecurity metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be adequate.
UNCERTRELhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueuncertain reliabilitySecurity metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be uncertain.
UNRELIABLEhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueunreliableSecurity metadata observation value used to indicate that the veracity or trustworthiness of an IT resource (data, information object, service, or system capability) for a specified purpose of use is perceived to be or deemed by policy to be inadequate.
_SECINTPRVOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueprovenanceAbstract security metadata observation value used to indicate the provenance of an IT resource (data, information object, service, or system capability). **Examples:** Codes conveying the provenance metadata about the entity reporting an IT resource.
_SECINTPRVABOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueprovenance asserted byAbstract security provenance metadata observation value used to indicate the entity that asserted an IT resource (data, information object, service, or system capability). **Examples:** Codes conveying the provenance metadata about the entity asserting the resource.
CLINASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValueclinician assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a clinician.
DEVASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuedevice assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a device.
HCPASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuehealthcare professional assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a healthcare professional.
PACQASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuepatient acquaintance assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a patient acquaintance.
PATASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuepatient assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a patient.
PAYASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuepayer assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a payer.
PROASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValueprofessional assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a professional.
SDMASThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesubstitute decision maker assertedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was asserted by a substitute decision maker.
_SECINTPRVRBOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueprovenance reported byAbstract security provenance metadata observation value used to indicate the entity that reported the resource (data, information object, service, or system capability). **Examples:** Codes conveying the provenance metadata about the entity reporting an IT resource.
CLINRPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValueclinician reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a clinician.
DEVRPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuedevice reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a device.
HCPRPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuehealthcare professional reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a healthcare professional.
PACQRPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuepatient acquaintance reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a patient acquaintance.
PATRPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuepatient reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a patient.
PAYRPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuepayer reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a payer.
PRORPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValueprofessional reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a professional.
SDMRPThttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesubstitute decision maker reportedSecurity provenance metadata observation value used to indicate that an IT resource (data, information object, service, or system capability) was reported by a substitute decision maker.
_SECINTSTOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueintegrity statusAbstract security observation values used to indicate integrity status metadata. **Examples:** Codes, such as those in the HL7 DocumentClassification code system conveying the workflow status of resource as authenticated, legally authenticated, and in progress.
SECTRSTOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuesecurity trust observationObservation value used to indicate aspects of trust applicable to an IT resource (data, information object, service, or system capability).
TRSTACCRDOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuetrust accreditation observationValues for security trust accreditation metadata observation made about the formal declaration by an authority or neutral third party that validates the technical, security, trust, and business practice conformance of Trust Agents to facilitate security, interoperability, and trust among participants within a security domain or trust framework.
TRSTAGREOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuetrust agreement observationValues for security trust agreement metadata observation made about privacy and security requirements with which a security domain must comply. \[ISO IEC 10181-1\] \[ISO IEC 10181-1\]
TRSTCERTOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuetrust certificate observationValues for security trust certificate metadata observation made about a set of security-relevant data issued by a security authority or trusted third party, together with security information which is used to provide the integrity and data origin authentication services for an IT resource (data, information object, service, or system capability). \[Based on ISO IEC 10181-1\] For example, a Certificate Policy (CP), which is a named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements. A particular Certificate Policy might indicate the applicability of a type of certificate to the authentication of electronic data interchange transactions for the trading of goods within a given price range. Another example is Cross Certification with Federal Bridge.
TRSTFWKOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuenone supplied 5Values for security trust framework metadata observation made about a complete set of contracts, regulations or commitments that enable participating actors to rely on certain assertions by other actors to fulfill their information security requirements. \[Kantara Initiative\]
TRSTLOAOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuetrust assurance observationValues for security trust assurance metadata observation made about the digital quality or reliability of a trust assertion, activity, capability, information exchange, mechanism, process, or protocol.
LOAANhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueauthentication level of assurance valueThe value assigned as the indicator of the digital quality or reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] For example, the degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\]
LOAAN1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow authentication level of assuranceIndicator of low digital quality or reliability of the digital reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] Low authentication level of assurance indicates that the relying party may have little or no confidence in the asserted identity's validity. Level 1 requires little or no confidence in the asserted identity. No identity proofing is required at this level, but the authentication mechanism should provide some assurance that the same claimant is accessing the protected transaction or data. A wide range of available authentication technologies can be employed and any of the token methods of Levels 2, 3, or 4, including Personal Identification Numbers (PINs), may be used. To be authenticated, the claimant must prove control of the token through a secure authentication protocol. At Level 1, long-term shared authentication secrets may be revealed to verifiers. Assertions issued about claimants as a result of a successful authentication are either cryptographically authenticated by relying parties (using approved methods) or are obtained directly from a trusted party via a secure authentication protocol. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAN2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic authentication level of assuranceIndicator of basic digital quality or reliability of the digital reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] Basic authentication level of assurance indicates that the relying party may have some confidence in the asserted identity's validity. Level 2 requires confidence that the asserted identity is accurate. Level 2 provides for single-factor remote network authentication, including identity-proofing requirements for presentation of identifying materials or information. A wide range of available authentication technologies can be employed, including any of the token methods of Levels 3 or 4, as well as passwords. Successful authentication requires that the claimant prove through a secure authentication protocol that the claimant controls the token. Eavesdropper, replay, and online guessing attacks are prevented. Long-term shared authentication secrets, if used, are never revealed to any party except the claimant and verifiers operated by the CSP; however, session (temporary) shared secrets may be provided to independent verifiers by the CSP. Approved cryptographic techniques are required. Assertions issued about claimants as a result of a successful authentication are either cryptographically authenticated by relying parties (using approved methods) or are obtained directly from a trusted party via a secure authentication protocol. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAN3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium authentication level of assuranceIndicator of medium digital quality or reliability of the digital reliability of verification and validation of the process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] Medium authentication level of assurance indicates that the relying party may have high confidence in the asserted identity's validity. Level 3 is appropriate for transactions that need high confidence in the accuracy of the asserted identity. Level 3 provides multifactor remote network authentication. At this level, identity-proofing procedures require verification of identifying materials and information. Authentication is based on proof of possession of a key or password through a cryptographic protocol. Cryptographic strength mechanisms should protect the primary authentication token (a cryptographic key) against compromise by the protocol threats, including eavesdropper, replay, online guessing, verifier impersonation, and man-in-the-middle attacks. A minimum of two authentication factors is required. Three kinds of tokens may be used: * "soft" cryptographic token, which has the key stored on a general-purpose computer, * "hard" cryptographic token, which has the key stored on a special hardware device, and * "one-time password" device token, which has symmetric key stored on a personal hardware device that is a cryptographic module validated at FIPS 140-2 Level 1 or higher. Validation testing of cryptographic modules and algorithms for conformance to Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Modules, is managed by NIST. Authentication requires that the claimant prove control of the token through a secure authentication protocol. The token must be unlocked with a password or biometric representation, or a password must be used in a secure authentication protocol, to establish two-factor authentication. Long-term shared authentication secrets, if used, are never revealed to any party except the claimant and verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent verifiers by the CSP. Approved cryptographic techniques are used for all operations. Assertions issued about claimants as a result of a successful authentication are either cryptographically authenticated by relying parties (using approved methods) or are obtained directly from a trusted party via a secure authentication protocol. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAN4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh authentication level of assuranceIndicator of high digital quality or reliability of the digital reliability of the verification and validation process used to verify the claimed identity of an entity by securely associating an identifier and its authenticator. \[Based on ISO 7498-2\] The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. \[OMB M-04-04 E-Authentication Guidance for Federal Agencies\] High authentication level of assurance indicates that the relying party may have very high confidence in the asserted identity's validity. Level 4 is for transactions that need very high confidence in the accuracy of the asserted identity. Level 4 provides the highest practical assurance of remote network authentication. Authentication is based on proof of possession of a key through a cryptographic protocol. This level is similar to Level 3 except that only “hard� cryptographic tokens are allowed, cryptographic module validation requirements are strengthened, and subsequent critical data transfers must be authenticated via a key that is bound to the authentication process. The token should be a hardware cryptographic module validated at FIPS 140-2 Level 2 or higher overall with at least FIPS 140-2 Level 3 physical security. This level requires a physical token, which cannot readily be copied, and operator authentication at Level 2 and higher, and ensures good, two-factor remote authentication. Level 4 requires strong cryptographic authentication of all parties and all sensitive data transfers between the parties. Either public key or symmetric key technology may be used. Authentication requires that the claimant prove through a secure authentication protocol that the claimant controls the token. Eavesdropper, replay, online guessing, verifier impersonation, and man-in-the-middle attacks are prevented. Long-term shared authentication secrets, if used, are never revealed to any party except the claimant and verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent verifiers by the CSP. Strong approved cryptographic techniques are used for all operations. All sensitive data transfers are cryptographically authenticated using keys bound to the authentication process. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAPhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueauthentication process level of assurance valueThe value assigned as the indicator of the digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\]
LOAAP1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow authentication process level of assuranceIndicator of the low digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] Low authentication process level of assurance indicates that (1) long-term shared authentication secrets may be revealed to verifiers; and (2) assertions and assertion references require protection from manufacture/modification and reuse attacks. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAP2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic authentication process level of assuranceIndicator of the basic digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] Basic authentication process level of assurance indicates that long-term shared authentication secrets are never revealed to any other party except Credential Service Provider (CSP). Sessions (temporary) shared secrets may be provided to independent verifiers by CSP. Long-term shared authentication secrets, if used, are never revealed to any other party except Verifiers operated by the Credential Service Provider (CSP); however, session (temporary) shared secrets may be provided to independent Verifiers by the CSP. In addition to Level 1 requirements, assertions are resistant to disclosure, redirection, capture and substitution attacks. Approved cryptographic techniques are required. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAP3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium authentication process level of assuranceIndicator of the medium digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] Medium authentication process level of assurance indicates that the token can be unlocked with password, biometric, or uses a secure multi-token authentication protocol to establish two-factor authentication. Long-term shared authentication secrets are never revealed to any party except the Claimant and Credential Service Provider (CSP). Authentication requires that the Claimant prove, through a secure authentication protocol, that he or she controls the token. The Claimant unlocks the token with a password or biometric, or uses a secure multi-token authentication protocol to establish two-factor authentication (through proof of possession of a physical or software token in combination with some memorized secret knowledge). Long-term shared authentication secrets, if used, are never revealed to any party except the Claimant and Verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent Verifiers by the CSP. In addition to Level 2 requirements, assertions are protected against repudiation by the Verifier.
LOAAP4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh authentication process level of assuranceIndicator of the high digital quality or reliability of a defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier. \[Based on NIST SP 800-63-2\] High authentication process level of assurance indicates all sensitive data transfer are cryptographically authenticated using keys bound to the authentication process. Level 4 requires strong cryptographic authentication of all communicating parties and all sensitive data transfers between the parties. Either public key or symmetric key technology may be used. Authentication requires that the Claimant prove through a secure authentication protocol that he or she controls the token. All protocol threats at Level 3 are required to be prevented at Level 4. Protocols shall also be strongly resistant to man-in-the-middle attacks. Long-term shared authentication secrets, if used, are never revealed to any party except the Claimant and Verifiers operated directly by the CSP; however, session (temporary) shared secrets may be provided to independent Verifiers by the CSP. Approved cryptographic techniques are used for all operations. All sensitive data transfers are cryptographically authenticated using keys bound to the authentication process. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAShttp://terminology.hl7.org/CodeSystem/v3-ObservationValueassertion level of assurance valueThe value assigned as the indicator of the high quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes.
LOAAS1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow assertion level of assuranceIndicator of the low quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Assertions and assertion references require protection from modification and reuse attacks. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAS2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic assertion level of assuranceIndicator of the basic quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Assertions are resistant to disclosure, redirection, capture and substitution attacks. Approved cryptographic techniques are required for all assertion protocols. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAS3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium assertion level of assuranceIndicator of the medium quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Assertions are protected against repudiation by the verifier. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOAAS4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh assertion level of assuranceIndicator of the high quality or reliability of the statement from a Verifier to a Relying Party (RP) that contains identity information about a Subscriber. Assertions may also contain verified attributes. Strongly resistant to man-in-the-middle attacks. "Bearer" assertions are not used. "Holder-of-key" assertions may be used. RP maintains records of the assertions. \[Summary of the technical requirements specified in NIST SP 800-63 for the four levels of assurance defined by the December 2003, the Office of Management and Budget (OMB) issued Memorandum M-04-04, E-Authentication Guidance for Federal Agencies.\]
LOACMhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuetoken and credential management level of assurance value)Indicator of the digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and its binding to an identity. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow token and credential management level of assuranceIndicator of the low digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and its binding to an identity. Little or no confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include weak identity binding to tokens and plaintext passwords or secrets not transmitted across a network. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic token and credential management level of assuranceIndicator of the basic digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and its binding to an identity. Some confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include: Verification must prove claimant controls the token; token resists online guessing, replay, session hijacking, and eavesdropping attacks; and token is at least weakly resistant to man-in-the middle attacks. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium token and credential management level of assuranceIndicator of the medium digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and it’s binding to an identity. High confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include: Ownership of token verifiable through security authentication protocol and credential management protects against verifier impersonation attacks. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOACM4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh token and credential management level of assuranceIndicator of the high digital quality or reliability of the activities performed by the Credential Service Provider (CSP) subsequent to electronic authentication registration, identity proofing and issuance activities to manage and safeguard the integrity of an issued credential and it’s binding to an identity. Very high confidence that an individual has maintained control over a token that has been entrusted to him or her and that that token has not been compromised. Characteristics include: Verifier can prove control of token through a secure protocol; credential management supports strong cryptographic authentication of all communication parties. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAIDhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueidentity proofing level of assuranceIndicator of the quality or reliability in the process of ascertaining that an individual is who he or she claims to be.
LOAID1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow identity proofing level of assuranceIndicator of low digital quality or reliability in the process of ascertaining that an individual is who he or she claims to be. Requires that a continuity of identity be maintained but does not require identity proofing. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAID2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic identity proofing level of assuranceIndicator of some digital quality or reliability in the process of ascertaining that that an individual is who he or she claims to be. Requires identity proofing via presentation of identifying material or information. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAID3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium identity proofing level of assuranceIndicator of high digital quality or reliability in the process of ascertaining that an individual is who he or she claims to be. Requires identity proofing procedures for verification of identifying materials and information. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOAID4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh identity proofing level of assuranceIndicator of high digital quality or reliability in the process of ascertaining that an individual is who he or she claims to be. Requires identity proofing procedures for verification of identifying materials and information. \[Based on Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOANRhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuenon-repudiation level of assurance valueIndicator of the digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow non-repudiation level of assuranceIndicator of low digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic non-repudiation level of assuranceIndicator of basic digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium non-repudiation level of assuranceIndicator of medium digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOANR4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh non-repudiation level of assuranceIndicator of high digital quality or reliability in the process of establishing proof of delivery and proof of origin. \[Based on ISO 7498-2\]
LOARAhttp://terminology.hl7.org/CodeSystem/v3-ObservationValueremote access level of assurance valueIndicator of the digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organization’s security controls. \[Based on NIST SP 800-63-2\]
LOARA1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow remote access level of assuranceIndicator of low digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organization’s security controls. \[Based on NIST SP 800-63-2\]
LOARA2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic remote access level of assuranceIndicator of basic digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organization’s security controls. \[Based on NIST SP 800-63-2\]
LOARA3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium remote access level of assuranceIndicator of medium digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organization’s security controls. \[Based on NIST SP 800-63-2\]
LOARA4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh remote access level of assuranceIndicator of high digital quality or reliability of the information exchange between network-connected devices where the information cannot be reliably protected end-to-end by a single organization's security controls. \[Based on NIST SP 800-63-2\]
LOATKhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuetoken level of assurance valueIndicator of the digital quality or reliability of single and multi-token authentication. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK1http://terminology.hl7.org/CodeSystem/v3-ObservationValuelow token level of assuranceIndicator of the low digital quality or reliability of single and multi-token authentication. Permits the use of any of the token methods of Levels 2, 3, or 4. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK2http://terminology.hl7.org/CodeSystem/v3-ObservationValuebasic token level of assuranceIndicator of the basic digital quality or reliability of single and multi-token authentication. Requires single factor authentication using memorized secret tokens, pre-registered knowledge tokens, look-up secret tokens, out of band tokens, or single factor one-time password devices. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK3http://terminology.hl7.org/CodeSystem/v3-ObservationValuemedium token level of assuranceIndicator of the medium digital quality or reliability of single and multi-token authentication. Requires two authentication factors. Provides multi-factor remote network authentication. Permits multi-factor software cryptographic token. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
LOATK4http://terminology.hl7.org/CodeSystem/v3-ObservationValuehigh token level of assuranceIndicator of the high digital quality or reliability of single and multi-token authentication. Requires token that is a hardware cryptographic module validated at validated at Federal Information Processing Standard (FIPS) 140-2 Level 2 or higher overall with at least FIPS 140-2 Level 3 physical security. Level 4 token requirements can be met by using the PIV authentication key of a FIPS 201 compliant Personal Identity Verification (PIV) Card. \[Electronic Authentication Guideline - Recommendations of the National Institute of Standards and Technology, NIST Special Publication 800-63-1, Dec 2011\]
TRSTMECOBVhttp://terminology.hl7.org/CodeSystem/v3-ObservationValuenone supplied 6Values for security trust mechanism metadata observation made about a security architecture system component that supports enforcement of security policies.
Lhttp://terminology.hl7.org/CodeSystem/v3-Confidentialitylow*Definition:* Privacy metadata indicating that the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity. *Examples:* Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets. *Map:* No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD\_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services. *Usage Note:* This metadata indicates the receiver may have an obligation to comply with a data use agreement.
Mhttp://terminology.hl7.org/CodeSystem/v3-Confidentialitymoderate*Definition:* Privacy metadata indicating moderately sensitive information, which presents moderate risk of harm if disclosed without authorization. *Examples:* Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws. *Map:* Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD\_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff). *Usage Note:* This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies.
Nhttp://terminology.hl7.org/CodeSystem/v3-Confidentialitynormal*Definition:* Privacy metadata indicating that the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization. *Examples:* In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance. *Map:* Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations. *Usage Note:* This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization.
Rhttp://terminology.hl7.org/CodeSystem/v3-ConfidentialityrestrictedPrivacy metadata indicating highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be pre-empted by jurisdictional law, e.g., for public health reporting or emergency treatment. *Examples:* Includes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patient's standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual, e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer. *Map:* Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations.. *Usage Note:* This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization..
Uhttp://terminology.hl7.org/CodeSystem/v3-Confidentialityunrestricted*Definition:* Privacy metadata indicating that the information is not classified as sensitive. *Examples:* Includes publicly available information, e.g., business name, phone, email or physical address. *Usage Note:* This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestricted" to that information even if it is publicly available.
Vhttp://terminology.hl7.org/CodeSystem/v3-Confidentialityvery restricted. Privacy metadata indicating that the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence. *Examples:* Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under “legal lock� or attorney-client privilege *Map:* This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject. *Usage Note:* This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject.
_Confidentialityhttp://terminology.hl7.org/CodeSystem/v3-ConfidentialityConfidentialityA specializable code and its leaf codes used in Confidentiality value sets to value the Act.Confidentiality and Role.Confidentiality attribute in accordance with the definition for concept domain "Confidentiality".

Explanation of the columns that may appear on this page:

Level A few code lists that FHIR defines are hierarchical - each code is assigned a level. In this scheme, some codes are under other codes, and imply that the code they are under also applies
Source The source of the definition of the code (when the value set draws in codes defined elsewhere)
Code The code (used as the code in the resource instance)
Display The display (used in the display element of a Coding). If there is no display, implementers should not simply display the code, but map the concept into their application
Definition An explanation of the meaning of the concept
Comments Additional notes about how to use the code

History

DateActionAuthorCustodianComment
2020-05-06reviseTed KleinVocabulary WGMigrated to the UTG maintenance environment and publishing tooling.
2014-03-26reviseVocabulary (Woody Beeler) (no record of original request)2014T1_2014-03-26_001283 (RIM release ID)Lock all vaue sets untouched since 2014-03-26 to trackingId 2014T1_2014_03_26