Saturday

Jan 12

AM

Q1

Q2

PM

Q3

Q4

Joint CBCP - Security

CBCP WGM Agenda Confluence: 2019-01 January CBCP WGM Agenda/Minutes San Antonio

Adding PSAF (TF4FA) Vol 1&2 Publication Request approved on 1/8 Security call for review and approval to move forward at Monday night InfraSD meeting.

Opening Security WG Meeting

• Introductions
• Approval of agenda
• International Report outs
• Liaison Reports: ISO, IHE, ONC, OASIS
  • OASIS XSPA-SAML Update

FHIR Security Report out/S&P Considerations - John Moehrke

• HL7 Project status and WGM planned project activities:
• FHIR Connectathon Report Out - Kathleen
• PSAF Vol. 3 Provenance Ballot Report - Mike Davis
• [ PSAF Project Scope Statement Refresh] & PSAF Vol 0 - Next Steps overview - Mike Davis

V3_PSAF_TF4FA_Vol3_Provenance_2019_120218_FINAL.pdf

PSAF Volume 3 Provenance Reconciliation Spreadsheet

Reaffirmation Ballots

• Security Privacy and Security Ontology
• Healthcare Privacy and Security Classification System
• Security Labeling Service

• Future FHIR-Security and Privacy topics
• Drill down of FHIR Security-Privacy activities
• GF#19312 - Document X-Consent header

 Joint FHIR Privacy and Security Topics 

• FHIR Connectathon Findings - Deep Dive
• FHIR Consent and FHIR Contract & Comparison white paper review
• Potential data provenance project for C-CDA/US Core - Brett Marquard
  • US Core Data for Interoperability (USCDI) Data Provenance IG presentation
  • Basic Provenance IG PPS

 Birds of a Feather

Joint WG In-depth discussion

Security topics for the agenda

1. TF4FA Vol. 3 and Reaffirmation Ballots Report - Mike Davis
2. PSAF Project Scope Update - Mike Davis
3. S&P Considerations for FHIR - John Moehrke
4. Report on FHIRcast – Isaac

• Security rep to PAC

PSAF Volume 3 Provenance

Reaffirmation Ballots

• Security Privacy and Security Ontology
• Healthcare Privacy and Security Classification System
• Security Labeling Service

S&P Considerations for FHIR

LLoyds FHIR R5 evaluation

• S&P Considerations for FHIR
  • https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=20002 with assessment of "Security Considerations"
  • https://docs.google.com/spreadsheets/d/157TFJAfAd_e7RHufVUy03fCM_paCtaV_K8WIT5x1mqE/edit with matrix of (too many!) assignments
• SMART Backend Services -- overview of status/progress at https://github.com/smart-on-fhir/fhir-bulk-data-docs

see open issues

9167 AuditEvent+needs+to+make+more+obvious+how+to+record+a+break-glass+event (John Moehrke)
10343 Three+additional+Signature.type+codes (Kathleen Connor)
11071 Improve+security+label+guidance+-+2016-09+core+%2390 (Kathleen Connor) 
12660 HCS+use+clarification (John Moehrke) 
17192 Verification+of+given+resource+without+changing+the+content (Thomas Johansen) 
17299 enhance+current+disclosure+AuditEvent+so+that+it+explains+what+is+being+recorded+and+why (John Moehrke) 
17300 Break-Glass+description+needs+clarifications (John Moehrke) 
17552 How+should+SMART+scopes+address+HIPAA%27s+%27minimum+necessary%27+requirement%3F (Kensaku Kawamoto) 
17675 Security+page%28s%29+should+express+mitigation+of+keeping+Resource+minimally+populated (John Moehrke) 
17676 security+page%28s%29+should+discuss+the+exposure+of+a+Resource+link+may+expose+more+than+is+obviou (John Moehrke) 
18088 AuditEvent+should+have+a+severity+element+to+support+many+levels+of+events (John Moehrke) 
18294 How+should+provenance+be+migrated%3F (Lloyd McKenzie) 
18874 Describe+use+of+Provenance+as+De-Identification+linking+for+Re-Identification (John Moehrke) 
19311 Security+Integrity+tag+for+a+Copy%2FDup (John Moehrke) 
19312 Document+X-Consent+header (John Moehrke) 
19410 Provenance+activity+type+value+set+is+still+broken (Lloyd McKenzie) 
19499 break-the-glass+needs+a+little+clarification. (Keith Boone) 
19644 AuditEvent+should+be+more+clear+in+scope+and+definition+as+generic+to+any+audit+event (John Moehrke) 
19755 AuditEvent+query+parameter+for+purposeOfUse (John Moehrke) 
14678 Implementation+guide+for+signatures+-+2018-Jan+Core+%231 (Brian Pech)

GDPR Session

• GDPR Chat-a-thon Findings
• GDPR White Paper
• Security GDPR Wiki
• Potential for a FHIR GDPR IG

Security FHIR Considerations

• Updates to FHIR Security and CBCP FHIR Resources
• FHIR FMM advancement for Security and Privacy Resources
• Security Considerations evaluation on FHIRcast (Isaac)
  • Security Considerations draft page describes the underlying security specifications, considerations and risk.

Review Governance, WG Health, Project Management, and post-WGM topics

• Workgroup Health Update - Security needs to publish S&P DAM and align 3 Year Plan with Project Insight Security Projects.

• Infrastructure Steering Division WG Health Report

• Security 3 Year Plan 2016
• Security 3 Year Plan 2018 draft
• Draft May 2019 Update to the HL7 Security Work Group Mission and Charter
• HL7 Security SWOT May 2019 - Draft from Jan 2019
• Security HL7 WG DMP 2017
• Confluence Security and CBCP structuring discussion