By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Public Key Infrastructure (PKI)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Public key infrastructure (PKI) is the framework of technology, policies, procedures, and people used to create, issue, manage, store, distribute, and revoke digital certificates, enabling public key cryptography for secure communication, authentication, and digital signatures.
The HIMSS Dictionary describes PKI as the technology, facilities, people, procedures, and policies that support public key security mechanisms and enable encryption and digital signatures. It also describes PKI as the infrastructure that allows anyone relying on a certificate to trust the identity of the certificate holder, including a certification authority, a certificate structure, a way to check whether certificates have been revoked, a certificate policy, and methods to validate certification practices.
| PKI Component | What It Does | Healthcare Example |
|---|---|---|
| Key Pair | A public key shared openly and a private key kept secret | A server’s key pair used for TLS connections |
| Digital Certificate | Binds a public key to an identity, signed by a trusted authority | The certificate on a patient portal website |
| Certificate Authority (CA) | Issues and signs certificates after verifying identity | A commercial or organizational CA |
| Registration Authority | Verifies identities before certificates are issued | Identity proofing for a prescriber’s signing certificate |
| Revocation Services | Publish which certificates are no longer valid | Certificate revocation lists or online status checks |
| Certificate Policy | Rules for issuing and using certificates | Requirements in a Direct trust framework |
⚠️ Exam Alert: In public key cryptography, data encrypted with a public key can be decrypted only with the matching private key, and a signature created with a private key can be verified with the public key. A certificate authority vouches for identity. PKI provides authentication, confidentiality, integrity, and non-repudiation. A compromised private key requires revocation of the certificate.
🌐 Why It Matters: Real-World Healthcare IT Context
PKI quietly underpins much of healthcare security. When a clinician opens a patient portal, an app connects to a FHIR API, a hospital sends a Direct message, or a prescriber signs an electronic prescription for a controlled substance, certificates and key pairs establish trust.
Encryption in transit depends on PKI. TLS connections use certificates to prove that a website or API is legitimate before establishing encrypted communication. Without trusted certificates, users could not tell a real portal from an impostor.
Digital signatures provide integrity and non-repudiation. A digital signature, created with a private key, shows that a document or message came from a specific sender and has not been altered. Electronic prescribing of controlled substances, for example, relies on strong identity proofing and two-factor authentication, with digital signatures applied to prescriptions.
Health information exchange relies on PKI trust frameworks. Direct secure messaging uses certificates bound to Direct addresses, and organizations participate in trust communities that define which certificate authorities are trusted. Federal agencies use the Federal PKI for employee credentials and secure communication.
NIST provides foundational guidance. SP 800-32 introduces public key technology and the Federal PKI, and SP 800-57 addresses key management, including how keys should be generated, protected, and retired.
Certificate lifecycle management is an operational challenge. Certificates expire, and an expired certificate can suddenly break websites, interfaces, APIs, or medical device connections. Industry groups that set rules for publicly trusted certificates have agreed to shorten maximum certificate lifetimes over the coming years, which makes automated renewal and accurate certificate inventories even more important.
Internal PKI is common in hospitals. Many organizations run their own certificate authorities to issue certificates for internal servers, devices, Wi-Fi authentication, and smart cards. Internal PKI gives control and flexibility but requires the same discipline as public PKI: protected root keys, documented policies, and processes for issuing and revoking certificates as devices and staff come and go.
Protecting private keys is essential. If a private key is stolen, attackers can impersonate the certificate holder or decrypt protected data. Hardware security modules, strict access controls, and rapid revocation processes reduce this risk.
Cryptography continues to evolve. Large-scale quantum computers could eventually break widely used public key algorithms, and NIST has published post-quantum standards. Organizations will need to update PKI systems and certificates as new algorithms are adopted.
Common PKI problems in healthcare:
- Expired certificates causing outages
- No inventory of certificates and owners
- Private keys stored insecurely
- Self-signed certificates that train users to ignore warnings
- Slow or incomplete revocation after compromise
- Legacy systems unable to support modern algorithms
Practices for strong PKI management:
- A complete certificate inventory with owners and expiration dates
- Automated renewal and monitoring
- Hardware security modules for critical keys
- Clear issuance and revocation procedures
- Strong identity proofing for signing certificates
- Planning for algorithm transitions, including post-quantum cryptography
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
PKI works mostly behind the scenes, but nurses notice when it fails.
At the Bedside
Browser warnings about invalid or expired certificates on clinical websites should be reported rather than bypassed. Clicking through warnings can expose data or lead to fake sites, and the warning may signal a real configuration problem that affects others.
Medical devices, mobile apps, and interfaces may stop communicating when certificates expire. A sudden failure of a device connection or an outside portal is sometimes a certificate problem, and reporting the time and affected system helps teams find the cause quickly.
In Clinical Workflow
Advanced practice nurses who prescribe controlled substances electronically go through identity proofing and use two-factor authentication, steps tied to PKI-based signing. Protecting tokens and never sharing credentials preserves the integrity of these signatures.
Secure messaging and Direct exchange rely on certificates to ensure messages reach the intended recipient. When referrals or summaries fail to send, certificate or trust configuration issues may be involved.
Digital signatures on documents, such as consents captured electronically, help prove who signed and that the document was not altered afterward.
Badge-based logins and Wi-Fi access on some devices also rely on certificates. When a device suddenly cannot connect to the network, an expired device certificate may be the cause.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, infrastructure teams install and test certificates for web services, interfaces, mobile apps, and remote access. Certificate expiration dates are tracked so renewals do not cause outages after Go-Live.
At-the-elbow support analysts may encounter certificate warnings on workstations or devices. Escalating these rather than instructing users to ignore them protects security and helps fix configuration errors early.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
PKI appears in security and interoperability questions:
| CAHIMS Domain | How PKI Appears |
|---|---|
| Healthcare & Technology Environments | Federal PKI; e-prescribing requirements; trust frameworks |
| Clinical Informatics | Certificate warnings, e-prescribing signatures, secure messaging |
| Healthcare Information & Systems Management | Certificates, CAs, revocation, key management, TLS |
| Management & Leadership | Certificate lifecycle governance, vendor requirements, risk management |
Key Terms to Know Alongside PKI
- Public Key Cryptography — encryption using mathematically linked public and private keys
- Digital Certificate — an electronic credential binding a public key to an identity
- Certificate Authority (CA) — a trusted entity that issues and signs certificates
- Digital Signature — a cryptographic mark proving origin and integrity
- Non-Repudiation — assurance that a sender cannot deny having sent a message
- Certificate Revocation — invalidating a certificate before its expiration
HIMSS Organizational Position
HIMSS supports strong identity, encryption, and trust frameworks through its cybersecurity and interoperability education and its Healthcare Cybersecurity Community. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — SP 800-32, Introduction to Public Key Technology and the Federal PKI Infrastructure https://csrc.nist.gov/pubs/sp/800/32/final
- NIST — SP 800-57 Part 1 Rev. 5, Recommendation for Key Management https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final
- NIST — SP 800-52 Rev. 2, Guidelines for TLS Implementations https://csrc.nist.gov/pubs/sp/800/52/r2/final
- CA/Browser Forum https://cabforum.org/
- ONC — Certification Test Method: Direct Project, 170.315(h)(1) https://healthit.gov/test-method/direct-project/
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply