This wiki has undergone a migration to Confluence found Here
<meta name="googlebot" content="noindex">

May 25th, 2010 Security Conference Call

From HL7Wiki
Jump to navigation Jump to search

Security Working Group Meeting

Back to Security Main Page

Attendees

Agenda

  1. (05 min) Roll Call, Approve minutes 11 May 2010, Call for additional agenda items & Accept Agenda
  2. (55 min) Composite Security & Privacy DAM ballot reconciliation

Minutes

1. Action Items - none

2. Resolutions - none

3. Updates/Discussion

Composite Security and Privacy DAM Ballot Reconciliation

  • Bernd presented results of the informal ballot reconciliation that took place during Q3 Tuesday May 18 at the Rio de Janeiro Working Group Meeting. The results are captured in the table on the last page of the Rio Work Group minutes
    • Bernd provided this table to share recorded opinions of the Rio participants for each of the comment items discussed during the informal Q3 ballot reconciliation process. (There were technical difficulties with the GoToMeeting call which prevented remote participants from joining).
    • The reconciliation decision recorded in Rio will be added to the disposition comment column in the spreadsheet to record the informal decisions made during that meeting.
  • Today's conference call was dedicated to the Composite Security & Privacy DAM ballot reconciliation. The recorded recommendations from the Rio meeting were elaborated on by Bernd Blobel and those comments were taken into strong consideration during today's formal reconciliation.
    • We were unable to get through all of the comments, so the we will continue reconciliation during the June 1st Security Work Group call.

Highlights of today’s discussion include:

  • Item #4: Custodian
  • The term Custodian has different definitions in different jurisdictions.
    • Custodian refers to the “non-patient” controller of protected information – someone other than the patient who is control of the information. An equivalent term in some European countries is “data controller”.
  • Resolution is to retain the original term Custodian and its definition but to remove all examples from the section since they are not valid in many regions.
    • We will also retain the comment indicating that Custodian is also called the “Trustee”, but the definition will become more generic by removing all examples from the text. Bernd and John M. will provide a precise definition for the term Custodian.

Item #7: SecurityRole

  • The class SecurityRole was added to replace the base class Role during January Security ballot resolution.
  • Bernd suggested the class names in all the diagrams be harmonized (e.g., change SecurityRole back to Role) and that two specializations – StructuralRole and FunctionalRole be added off the base class to the overview diagram.
  • Mike’s preference is to keep the simplicity of the diagram (retain the abstract class name SecurityRole and not include the specializations).
  • Ioana proposed to update the overview diagram and present it during next week’s meeting. This way we can defer the decision about adding specializations for the purpose of clarity until after that review.
    • It was resolved to update the definition for the abstract base class SecurityRole to indicate that it has StructuralRole and FunctionalRole specializations.

Item #11: This comment goes back to Item #7 where Bernd suggested that the SecurityRole class be renamed to Role with specializations FunctionalRole and StructuralRole. The comment suggests that class names be identical throughout all diagrams within the artifact. Figure 1.3 is copied directly from the original Privacy DAM balloted in September 2009.

  • Ioana clarified that the diagrams contained in the harmonized DAM come from both the Privacy DAM (balloted in September 2009) and the January 2010 Security DAM, and that there are three different “Roles”.
    • SecurityRole is the base abstract class name we agreed to when we developed the Security DAM in January.
    • The class Role in Privacy is actually the StructuralRole. FunctionalRole is another specialization of Role.
    • There aren’t two names for the same thing, there are three different concepts, two of them – Structural and Functional Role are specializations of SecurityRole. These are not overlapping terms for the same concepts.
    • Bernd: You can either hide the specializations and reference the base class, or add the specializations to the diagrams and make them consistent across models and diagrams.
    • Mike: The Harmonized Model is intended is to replace the Privacy and Security Models. Recommendation to leave diagram 1.3 as is with an explanation that the harmonized model will eventually replace the Privacy DSTU once the Harmonized ballot is passed.
  • Ioana: The resolution to comment #11 is that we will rename the SecurityRole class in the harmonized DAM to Role (as an abstract base class) which has specializations StructuralRole and FunctionalRole.
    • The Privacy DAM DSTU is in its comment period so we can submit a change request against the DSTU to synchronize the two DAMS.
    • We will keep track of the changes that should be applied to the Privacy model based on the harmonization and when and the Harmonized Security and Privacy model is published, we can show what changes were necessary to the Privacy Model and submit the appropriate change requests (and/or withdraw the DSTU).

Ballot reconciliation resumes at comment #12 next week, June 1 at 1:00 PM EDT. Bernd Blobel is not able to attend the next two Security WG meetings. If our work group is in disagreement with any of the Rio informal disposition comments, we will review these items with Bernd (who can express the details of the Rio discussion) prior to taking a final vote.

Meeting was adjourned at 1:05 PM EDT No significant motions or decisions were made

Back to Security Main Page

Retrieved from "https://wiki.hl7.org/w/index.php?title=May_25th,_2010_Security_Conference_Call&oldid=38922"