December 14, 2010 Security Conference Call
Contents
Security Working Group Meeting
Attendees
- Mike Davis Security Co-chair
- Jon Farmer
- Suzanne Gonzales-Webb CBCC Co-chair
- Michelle Johnston
- Jim Kretz
- Milan Petkovic
- Diana Proud-Madruga
- Ken Salyards
- Richard Thoreson CBCC Co-chair
- Craig Winter
December 14, 2010 Agenda
Roll Call, Approve Minutes 12/7& Agenda Accepted'
Upcoming SECURITY Holiday Schedule
- No meetings on December 21, 28; January 4, 11
- NEXT Scheduled Meeting: January 18th, 2011
NOTE: CBCC Holiday Schedule December 21 - Informal Meeting December 28 - NO Meeting Next Official Meeting: - January 4, 2011
President's Council of Advisors on Science and Technology (PCAST) On December 8, the President's Council of Advisors on Science and Technology (PCAST) released a report entitled “Realizing the Full Potential of Health Information Technology to Improve Healthcare for Americans: The Path Forward"
- PCAST Press Release, 8 Dec 2010
- Report to the President Realizing the Full Potential of Health Information Technology to Improve Healthcare for Americans: The Path Forward, December 2010 (PDF)President’s Council of Advisors on Science and Technology (PCAST) Report, 8 Dec 2010
Reference:
(a) President’s Council of Advisors on Science and Technology (PCAST) Report, 8 Dec 2010
(b) Security Definitions and Use Case discussion of 7 Dec 2010
Extracts from (a) Technology for an Integrated Health IT Ecosystem pps 39-43.
This chapter’s bottom line: A universal language for the exchange of health data is needed. An extensible markup language, where individual pieces of data can be tagged with context-setting metadata, is a straightforward solution and is superior to other proposed architectures.
Security and Privacy Considerations pps. 45-51
This chapter's bottom line: The tagged data element approach allows for a sophisticated fine-grained model of implementing strong privacy controls (including honoring patient-controlled privacy preferences where applicable) and strong security protection.
This report endorses an approach for advanced security and privacy that has been advocated for a number of years in Standards Development Organizations. In both OASIS (XSPA and XACML TCs) and HL7 (Security and CBCC), projects involved with “data tagging” in one form or another have emerged as a means of enforcing advanced privacy and security. Note that “Information object attributes” is security speak for “data tagging” and “attribute-based access control (ABAC)” is the term used for the technology that uses attributes (tags) to enforce security and privacy rules.
ABAC has been demonstrated in presentations provided to RSA, HIMSS and most recently the Consumer Choice TT in June. In conclusion to the HHS TT we noted: “EHR systems need to be able to define and identify sensitive data if security systems are to enforce consumer choice regarding data sensitivity…”. Translation – Sensitive data needs to be tagged with security and privacy attributes.
There is an extensive body of standards available/emerging on this subject. OASIS eXtensible Access Control Markup Language (XACML) provides the technical approach and semantics for expressing and enforcing rules regarding “tagged” data. HITSP TP20 Access Control calls out this standard. XSPA profiles provide the means to exchange attributes among healthcare providers. HL7 standards including RBAC, the Harmonized Security and Privacy Information Model, Confidentiality Codes, CDA R2 Consent Directive standard etc. provide the means of expressing and sharing tagging information. Shipping products from IBM, Oracle, Jericho, Redhat and others are available in the marketplace.
From an architectural point of view, “data tagging” is an instance of an even broader conceptualization of information attributes that can include the user, contextual/environmental (what time, where, how many), the subject of the data etc fully supported by the standards above. Ongoing HL7 WG activities include a Security and Privacy Ontology to comprehensively map and define policy class attributes needed in healthcare and their incorporation into FHIMS. The following definition of segmentation (applied to security and privacy)…meaning the end result of applying and logically grouping similarly tagged data has been proposed to the HL7 Security/CBCC WG:
- “Segment (HITECH). A subset of specific and sensitive individually identifiable health information within a security domain whose members share one or more access control decision information attributes.
January 2011 Working Group Meeting - Sydney, Australia Security Agenda DRAFT (Not covered)
Segmentation continued? (Not covered)
Minutes
Roll Call Minutes Approved Agenda Accepted
Upcoming Holiday Schedule: No meetings (suggested): Dec 21, 28 Resume: Tuesday, Jan 04, 2011
