Agenda Approval

• Review and Approve: 2023-02-13 Security WG Agenda/Minutes (2023-02-20 Security WG Agenda/Minutes - Cancelled due to Presidents Day)
• Security WGM Agenda & Rooms
• Cancel next call?
  
• HL7 cyber security event
• FHIR DS4P IG
• FHIR Core
• HCS Reaffirmation
• DaVinci PoU codes

Approval of 2023-02-13 Security WG Agenda/Minute

Moved: Alex

Second: Joe

Vote: 6-0-1

Rita abstained.

John won't be available for next call 3/6.  Kathleen will cancel that call.

Action Items

• MAY WGM Agenda
• Room reservation status

2023 05 WGM+ || Notes to Co-chairs and Management Groups on Planning your Sessions

Per Chris Shawn: Security asked not to schedule WG sessions Monday Q1 and preferably not Q2, which we don’t normally anyway. HQ wants good attendance to kick off the Plus program.

We were also asked to review all the Plus sessions, and not schedule WG sessions that would conflict with Plus sessions on similar topics or during Plus sessions we otherwise think might be of interest to our WG members (e.g., maybe we don’t schedule security sessions that conflict with FAST).

HL7 cyber security event

Discussion about how Security WG can best assist with this effort.

Any news on why Security is in the TSC grouping or what the role of the representative is?

Mohammad - THO 5.1 released.  Needs to connect with IG.  Rest is administrative - do publication request.

HL7 cyber security event

For 3 year plan, we need to do a walk through of HL7 Healthcare Privacy and Security Classification System (HCS), Release 1

Question:  Can we simply reaffirm and allow the Security Label vocab to evolve independently?

See instructions J - Reaffirmation Ballot

Security Ballot Tracker

ANSI Standards approaching expiration 

Decide on whether to revise or just point to THO for vocab updates.  NIB must be completed for ballot before expiration on 20240607.

Last Reaffirmation

Unique Ballot ID: REAFF_HL7_PRIVSECCLASSSYS_R1_N1_2019JAN

From <http://www.hl7.org/documentcenter/public_temp_C758EC27-1C23-BA17-0C263FB82AB641AC/ballots/2019JAN/downloads/Reaffirmation%20of%20HL7%20Healthcare%20Privacy%20and%20Security%20Classification%20System%20Release%201%20Instructions.pdf>

Reaffirmation of HL7 Healthcare Privacy and Security Classification System, Release 1

International standard document describing the use of a Healthcare Privacy and

Security Classification System (HCS) suitable for automated labeling and

segmentation of protected health care information by access control systems to

enforce privacy and security policies

Reaffirmation of HL7 Healthcare Privacy and Security Classification System, Release 1 (1st Normative Ballot) - REAFF_HL7_PRIVSECCLASSSYS_R1_N1_2019JAN

Instruction Document<http://www.hl7.org/documentcenter/public/ballots/2019JAN/downloads/Reaffirmation%20of%20HL7%20Healthcare%20Privacy%20and%20Security%20Classification%20System%20Release%201%20Instructions.pdf>

Review the codes added to ValueSet: CDex Purpose of Use Value Set

CDEX POU code system and value set Da Vinci PoU codes

Da Vinci CDex IG has defined a number of PoU codes as an extension to the PoU codes in the core. 

http://build.fhir.org/ig/HL7/davinci-ecdx/branches/Sept2022Ballot/ValueSet-cdex-POU.html

Suggestion made that the DaVinci POU codes be added to Security WG POU codes in THO.

Comments

The concepts are already covered by current PurposeOfUse for DaVinci POUs:

• payment-nos Payment Not Otherwise Specified

[Healthcare Payment as defined by HIPAA](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html) and isn't defined further to ascertain a more detailed Purpose of Use concept.

• operations-nos Operations Not Otherwise Specified

[Healthcare Operations as defined by HIPAA](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html) and isn't defined further to ascertain a more detailed Purpose of Use concept.

Questions

Are these needed at all and should DaVinci value set authors have discuss the reasons they didn’t think the current codes aren’t sufficient with Security WG, steward of the THO POU codes, prior to creating new ones?

•  HPAYMT healthcare payment http://terminology.hl7.org/CodeSystem/v3-ActReason

To perform one or more operations on information for conducting financial or contractual activities related to payment for provision of health care

• HOPERAT healthcare operations http://terminology.hl7.org/CodeSystem/v3-ActReason

To perform one or more operations on information used for conducting administrative and contractual activities related to the provision of health care.

Did DaVinci think that they needed US HIPAA specific healthcare payment/operations codes?  Purpose of Use codes are meant to be associated with the prevailing realm privacy policy unless specifically associated with a realm-specific policy, e.g., 42 CFR Part 2 POUs are different from HIPAA POUs?

Moved FHIR Chats to separate page

FHIR Privacy and Security Zulip Chats

Security Project and Ballot Management Resources FAQs

Confluence and JIRA Tutorials

TSC Decisions