Statements

us-core-req-security-01	SHALL	Systems SHALL establish a risk analysis and management regime that conforms with HIPAA security regulatory requirements. \n
us-core-req-security-01-a	SHOULD	In addition US Federal systems SHOULD conform with the risk management and mitigation requirements defined in NIST 800 series documents. This SHOULD include security category assignment in accordance with NIST 800-60 vol. 2 Appendix D.14. The coordination of risk management and the related security and privacy controls – policies, administrative practices, and technical controls – SHOULD be defined in the Business Associate Agreement when available. \n Links: Parent: US Core 4.0.0 Requirements for US Core General Security Considerations # us-core-req-security-01-a
us-core-req-security-02	SHALL	Systems SHALL reference a single time source to establish a common time base for security auditing, as well as clinical data records, among computing systems. \n
us-core-req-security-02-a	SHOULD	The selected time service SHOULD be documented in the Business Associate Agreement when available. \n Links: Parent: US Core 4.0.0 Requirements for US Core General Security Considerations # us-core-req-security-02-a
us-core-req-security-03	SHALL	Systems SHALL keep audit logs of the various transactions. \n
us-core-req-security-04	SHALL	Systems SHALL use TLS version 1.2 or higher for all transmissions not taking place over a secure network connection. (Using TLS even within a secured network environment is still encouraged to provide defense in depth.) \n
us-core-req-security-04-a	SHOULD	US Federal systems SHOULD conform with FIPS PUB 140-2. \n Links: Parent: US Core 4.0.0 Requirements for US Core General Security Considerations # us-core-req-security-04-a
us-core-req-security-05	SHALL	Systems SHALL conform to FHIR Communications Security requirements. \n
us-core-req-security-06	SHALL	For Authentication and Authorization, Systems SHALL support the SMART App Launch Framework for client <-> server interactions. NOTE: The SMART on FHIR specifications include the required OAuth 2.0 scopes for enabling security decisions. \n
us-core-req-security-07	SHALL	Systems SHALL implement consent requirements per their state, local, and institutional policies. \n
us-core-req-security-07-a	SHOULD	The Business Associate Agreements SHOULD document systems mutual consent requirements. \n Links: Parent: US Core 4.0.0 Requirements for US Core General Security Considerations # us-core-req-security-07-a
us-core-req-security-08	SHOULD	Systems SHOULD provide Provenance statements using the US Core Provenance Profile resource and associated requirements. \n
us-core-req-security-09	MAY	Systems MAY implement the FHIR Digital Signatures and provide feedback on its appropriateness for US Core transactions. \n
us-core-req-security-10	MAY	Systems MAY protect the confidentiality of data at rest via encryption and associated access controls. The policies and methods used are outside the scope of this specification. \n