February 19, 2013 Security Working Group Conference Call
Contents
Security Working Group Meeting
Attendees
- Kathleen Connor
- Mike Davis Security Co-chair
- Suzanne Gonzales-Webb CBCC Co-chair
- John Moehrke Security Co-chair
- Diana Proud Madruga
- Pat Pyette
- Harry Rhodes
- Richard Thoreson CBCC Co-chair
- Tony Weida
Agenda
- (05 min) Roll Call, Approve Minutes & Accept Agenda
- (15 min) Security and Privacy Ontology - ballot resolution update per Feb 11, 2013 teleconference Tony Weida
- (15 min) HealthCare Classification System Ballot, Additions to Normative documentation
- (15 min) Item3
- (05 min) Other Business
Meeting Minutes
Roll Call, Approve Minutes & Accept Agenda
Security and Privacy Ontology
- ballot resolution update per Feb 11, 2013 teleconference
Healthcare Classification System
- addition of informative information to normative ballot document
BALLOTS Sunday, NIBs sent (two) ontology and HCS for May 2013, HCS submitted as DSTU Ontology submitted as normative
Intent to add guide for HCS as informative material in addition to the example that Kathleen did for the classes to the code values and intend a section to the normative ballot that is informative that will show how the tags might be applied to a document. (Slide presented <<add link>>)
- Basic idea; going between CAPCO and the use of security labels
- looking at how they look at labels in the display whether paper of electronic.
- SAMSHA C32,
Some of what will be demonstrated at HIMSS, the second piece / what is on the slide is an instance
Reviewed the ‘egg diagram’ – for normal, restricted, very restricted; <<add egg document link>> a security label is used conjunction with a clearance, a structured representation of what information is sensitive to a person (or other entity) is authorized to access and a security policy to control access to each piece of information
A security label, sometimes referred to as a confidentialiylabel is a structured representation of the sensitivity of a piece of information.
If you have to a document with both HIV and sickle cell but only have clearance for sickle cell, you may get a portion of the document with only the sickle cell OR you may not get any portion of the document even though sickle cell is included. Data has to be encoded in such a way to allow policy to be written against these policies / use cases.
