Stream: Post-Acute Care
Topic: Digital Signature shown
John Moehrke (Jan 15 2021 at 16:26):
@Matt Elrod can you point me to details on the digital signature you are doing? The document was a PDF, there was a CDA mentioned, and a Binary and DocumentReference indicated, .. just wondering the standards used, and the mechanics. is this what you have
DocumentReference -> Binary (XML-Signature(CDA(PDF)))? did you know about the IHE profile on how to do that digital Signature? Have you looked at detached vs encapsulating signature?
John Moehrke (Jan 15 2021 at 17:00):
so, looking at the DocumentReference and Binary... You have done it slightly differently. not a problem, just wondered how it was done.
John Moehrke (Jan 15 2021 at 17:00):
is that method of signature mandated by PACIO? Or is it just app choice?
John Moehrke (Jan 15 2021 at 17:05):
looks like you have
DocumentReference -> Binary( CDA(XML-Sig, PDF))
Matt Elrod (Jan 15 2021 at 19:22):
John Moehrke said:
Matt Elrod can you point me to details on the digital signature you are doing? The document was a PDF, there was a CDA mentioned, and a Binary and DocumentReference indicated, .. just wondering the standards used, and the mechanics. is this what you have
DocumentReference -> Binary (XML-Signature(CDA(PDF)))? did you know about the IHE profile on how to do that digital Signature? Have you looked at detached vs encapsulating signature?
@John Moehrke I reached out to @Lisa Nelson to provide more details. Below is her response.
MaxMD has implemented the HL7 Implementation Guide for CDA® Release 2: Digital Signatures and Delegation of Rights, Release 1
http://www.hl7.org/implement/standards/product_brief.cfm?product_id=375
The digital signature information is actually stored within the CDA Document that is signs. I’m not familiar with these phrased used as specific terms, detached vs encapsulating signature, however, I would say this HL7 standard we’ve implemented uses an encapsulated signature. Some of the work we are looking at for FHIR Resources and use of Provenance.signature would be a detached approach.
Please send more information about the IHE Profile on digital signature. I haven’t heard about it yet, nor seen any one implementing it.
Regards,
Lisa
John Moehrke (Jan 15 2021 at 21:05):
so the IHE Document Digital Signature is a solution that is not specific to only CDA. It is designed to work across any object, but it is intended to be used with the Document Sharing environments (XDS, XCA, XDR, XDM, and MHD ). The approach produces a second document, that is the signature. That second document is registered in parellel with the signed document. AND there is a relationship between the two. In FHIR Resource terms this is done with the DocumentReference.relatesTo.target with a .code of #signs. In this way apps that don't care about the signature can just process the signed document as a normal document, but those that need to see that a signature exists can see that in the DocumentReference metadata, and can follow that to get the signature and once that is retrieved they can do a signature validation. The one advantage is that the signature overhead does not burden everyone. The bigger advantage is that it works for ALL, not just CDA.
here is the IHE specification https://profiles.ihe.net/ITI/TF/Volume1/ch-37.html
It does also use the XML-Signature standard, so not much different technology, just assembled differently.
Last updated: Apr 12 2022 at 19:14 UTC
