HTTPS and why health data needs it

Health data on the wire must be protected

A request for a patient record crosses networks you do not control. Anyone along the way could read it, or change it. That is why health data needs more than plain H T T P. It needs the S.

http and https

The only visible difference is one letter in the scheme. Http sends the conversation as it is. Https sends the same conversation through a secure channel, which is set up by a protocol called T L S, Transport Layer Security. The address, the verbs and the status codes are exactly the same. What changes is who can read or alter the traffic on the way.

Three properties of the channel

The T L S standard says its main goal is a secure channel between two communicating peers, with three properties. Authentication: the server side of the channel is always authenticated, and the client side optionally. Confidentiality: data sent over the channel is only visible to the endpoints. And integrity: data sent over the channel cannot be modified without detection.

• Property 1 · Authentication · The server is always authenticated. · key
• Property 2 · Confidentiality · Only the endpoints can read it. · lock
• Property 3 · Integrity · Changes cannot go unnoticed. · check

Secure production data, authenticate clients

The FHIR specification is direct about this. All exchange of production data should be secured using T L S, for example H T T P S. Clients must be authenticated. And for web centric use, O Auth is recommended, and the SMART App Launch guide should be considered. T L S protects the channel. Authentication and authorization decide who may ask for what.

Check yourself

Pause and think. Which three properties does T L S aim to give a connection? The answer: authentication, confidentiality, and integrity.

• Authentication, confidentiality and integrity
• Speed, size and price
• Search, sort and filter
• Colour, layout and font

Keep these in mind

Https is the same conversation through a T L S secure channel. T L S gives authentication, confidentiality and integrity. FHIR says to secure production data with T L S. And a secure channel does not decide who may ask for what.

• https is the same conversation through a TLS secure channel
• TLS gives authentication, confidentiality and integrity
• FHIR says secure production data with TLS
• A secure channel does not decide who may ask for what