The product authenticates human users so that access to the product, to network resources and to health data is controlled and audit trails cannot be repudiated, identifying unambiguously and with certainty who accesses a resource; authentication policies must be flexible enough to follow HDO IT policy, the requirement eases during break-glass operation, and security measures must never get in the way of medical care or put patient safety at risk, so emergencies needing swift access have alternative secure methods founded on risk assessment. User needs include unique accounts with role-based access control, local and remote, for network-connected products; the ability for an authorised user to disable access controls where other means such as access-controlled rooms protect the software; account management on a modality; personal preferences tied to accounts; administration both stand-alone and central; single sign-on, biometrics, physical tokens or combinations; electronic signatures with the same effect as handwritten ones within the organisation, permanently linked to their record and carrying date and time, which requires signer authentication; and detection and prevention of person falsification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.