View source for HL7 FHIR Security 2016-3-1

==Call Logistics==
Weekly:
'''Tuesday at 05:00 EST''' (2 PM PST)
 
Conference Audio: '''770-657-9270,''' Access: '''845692''
 
'''Join online meeting: https://meet.RTC.VA.GOV/suzanne.gonzales-webb/67LLFDYV
 
''If you are having difficulty joining, please try: 
 
https://global.gotomeeting.com/join/520841173  
 
''' ''Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes'' '''
 
[[HL7 FHIR security topics|Back to HL7 FHIR security topics]]

==Attendees==
{| class="wikitable"
|-
! ||'''Member Name'''|| !!  ||'''Member Name''' !!|| ||'''Member Name''' !!
|-
||  x||[mailto:john.moehrke@ge.med.com John Moehrke] Security Co-Chair
||||x||[mailto:Kathleen_Connor@comcast.net Kathleen Connor] Security Co-Chair
||||.||[mailto:suzanne.webb@engilitycorp.com Suzanne Gonzales-Webb] CBCC Co-Chair   
|-
||  .||[mailto:gary.dickinson@ehr-standards.com Gary Dickinson] EHR Co-Chair
||||.||[mailto:jc@securityrs.com Johnathan Coleman]CBCC Co-Chair
||||.||[mailto:Mike.Davis@va.gov Mike Davis]
|-
||  .||[mailto:rgelzer@provider-resources.com Reed Gelzer] RM-ES Lead
||||x||[mailto:gfm@securityrs.com Glen Marshal]
||||.||[mailto:Galen.Mulrooney@JPSys.com Galen Mulrooney]
|-
||  .||[mailto:dsilver@electrosoft-inc.com Dave Silver]
||||x||[mailto:robert.horn@agfa.com Rob Horn] 
||||x||[mailto:Judith.Fincher@va.gov Judy Fincher]
|-
||  x|| [mailto:Diana.Proud-Madruga@engilitycorp.com Diana Proud-Madruga]
||||.|| [mailto:Beth.Pumo@kp.org Beth Pumo]
||||x||[mailto:oliver@lawless.co Oliver Lawles]
|-
|}

==Agenda==
*Roll; approval of agenda and [http://wiki.hl7.org/index.php?title=HL7_FHIR_Security_2016-2-23 February 23 minutes]
*Block vote
*Check on block items that have been requested to be pulled - e.g., Kathleen requests that CP 9417 be pulled.  Reason: she's revised 9417 based on last call's discussion proposing both a Provenance.lifecycle element for lifecycle state of the target, and a Provenance.entity.lifecycle element for the lifecycle of any entity that is an input to the activity that generated the of the target.  This supports lifecycle management and traceability, which is a core prinicple to ONC and HL7 Data Provenance work
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9593 9593] Improve advice for Access Denied response (John Moehrke) Persuasive
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9417 9417] Add a new Provenance.entity.lifecycle element to align with Audit.entity.lifecycle. Align definitions. (Kathleen Connor) Persuasive with Mod
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9562 9562] Change Signature Datatype - make blob 0..1 (Kathleen Connor) Persuasive with Mod
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9570 9570] Change AuditEvent.agent definitions (Kathleen Connor) Persuasive with Mod
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9571 9571] Change Provenance.agent definition (Kathleen Connor) Persuasive with Mod
* Next set of discussion
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=7568 7568] 2015May core #859 - How are agent and activity linked? (Kathleen Connor) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9407 9407] Align AuditEvent and Provenance action/activity element. Recommend "Provenance.activity". (Kathleen Connor) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9150 9150] Provenance TODO section cleanup (John Moehrke) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9151 9151] AuditEvent has TODO section to be removed (John Moehrke) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9166 9166] Break-Glass method defined doesn't include AuditEvent effect. (John Moehrke) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9167 9167] AuditEvent needs to make more obvious how to record a break-glass event (John Moehrke) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9176 9176] Security-Labels page for _confidentialiy points at all "Confidentiality" codes, not just _confidentiality. (John Moehrke) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9563 9563] Add onBehalfOf to Signature datatype (Kathleen Connor) None
**[http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9564 9564] Should FHIR AuditEvent resource include DICOM extension of ATNA Audit log message ? (Madhusudana B Shivalinge Gowda) None

==Minutes==
*9417 pulled per Kathleen's request and update to the CP from block for further discussion in Security WG about whether predecessor lifecycle status of input entities should be included along with Provenance.target lifecycle, which there was concensus about on 2/23 FHIR Security call.
*RE [http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9570 CP 9570 Change AuditEvent.agent definitions] Rob objected to the term "some degree of responsibility"  proposed a change to the AuditEvent.agent definition: An actor taking a role in an activity  for which it can be assigned some degree of responsibility for the activity taking place." In discussion, Kathleen and Diana did not think that "some degree of responsibility" as too strong, e.g., a storm can be said to be "responsible for the tree falling through the roof".  However, the group agreed to modify the definition to "An actor taking an active role in the activity that is logged."
*John discussed Grahame's suggested changes to [http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9593 CP 9593 Improved advice for Access Denied response], which entails limiting return of empty Bundle to a response to a query.
*The block vote: CP 9593, 9562, 9570, and 9571 were moved by Glen, seconded by Kathleen, and approved with the amendments described above 0-0-5.
*Discussion on other CPs focused on CP 9407, which recommends using the Provenance.activity definition from W3C "An activity is something that occurs over a period of time and acts upon or with entities; it may include consuming, processing, transforming, modifying, relocating, using, or generating entities"as a base for the other S&P FHIR Resources.
Concerns were expressed about including the beginning "An activity is something..." because it might be tautological.  Diana pointed out that it is not.  However, in the context in which Provenance.activity is defined, where the first cell is "definition", the phrase "An activity is..." is redundant.  The definition intended in the CP was "Something that occurs over a period of time..."
*Oliver and others were concerned that the phrase "period of time" precludes a snapshot.  However, Provenance.period datatype supports both an instance and a period with start and end, so some did not think this was a issue, and preferred staying as close as possible to the W3C definition.
*Oliver argued that FHIR should not be based on W3C.  Others pointed out that this was a foundational decision since the inception of this resource.
*Given that no consensus seemed forthcoming, Kathleen called for moving the discussion up to the Security WG along with CP 9417, where all of the sub-WG decisions need to be vetted for final approval.