HL7 FHIR Security 2016-2-23

Call Logistics

Weekly: Tuesday at 05:00 EST (2 PM PST)

Conference Audio: 770-657-9270,' Access: 845692

Join online meeting: https://meet.RTC.VA.GOV/suzanne.gonzales-webb/67LLFDYV

If you are having difficulty joining, please try:

https://global.gotomeeting.com/join/520841173

Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes

Back to HL7 FHIR security topics

Attendees

	Member Name			Member Name			Member Name
	John Moehrke Security Co-Chair		x	Kathleen Connor Security Co-Chair		x	Suzanne Gonzales-Webb CBCC Co-Chair
	Gary Dickinson EHR Co-Chair			Johnathan ColemanCBCC Co-Chair			Mike Davis
	Reed Gelzer RM-ES Lead		x	Glen Marshal			Galen Mulrooney
	Dave Silver			Rob Horn		x	Judy Fincher
	Diana Proud-Madruga			[mailto:]			[mailto:]

Agenda

• Roll; approval of agenda and February 16 minutes

• FHIR P&S Resource Element Harmonization map

Implement the following changes per 2 new CPs

• CP 1: Align AuditEvent and Provenance action/activity element name and definition. Recommend changing to "activity".

AuditEvent.action [Change to AuditEvent.activity

Question: What to do with the definitional differences - e.g., possibly combine. Current AuditEven.action Definition: Indicator for type of action [Change to "activity".] performed during the event that generated the audit. Control 0..1 Binding AuditEventAction: Indicator for type of action[Change to "activity".] performed during the event that generated the audit. (Required) Type code Requirements This broadly indicates what kind of action [Change to "activity".] was done on the AuditEvent.entity by the AuditEvent.agent.

• Provenance.activity

Definition: An activity is something that occurs over a period of time and acts upon or with entities; it may include consuming, processing, transforming, modifying, relocating, using, or generating entities. Control 0..1 Binding ProvenanceEventCurrentState: The activity that took place. (Extensible) Type Coding

• [http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=9417

CP 9417]: Add to Provenance Resource a new Provenance.entity.lifecycle element to align with Audit.entity.lifecycle. Current Audit.entity.lifecycle Definition Identifier for the data life-cycle stage for the entity. Control 0..1 Binding AuditEventObjectLifecycle: Identifier for the data life-cycle stage for the object. (Extensible) Type Coding Requirements Institutional policies for privacy and security may optionally fall under different accountability rules based on data life cycle. This provides a differentiating value for those cases. Comments This can be used to provide an audit trail for data, over time, as it passes through the system." Possible Provenance.entity.lifecycle would be the same as the Audit.entity.lifecycle.

Minutes

• John chaired.
• John reported implementingSecurity CP 9534 - Change Contract Actor to Agent and FM CP 9536 Change the name of current Contract.subject to Contract.topic, and update current definitions. He's checking why these changes are not showing in the Build.
• Discussion focused primarily on the CPs related to changes to harmonize actor to agent definitions and comments:
• Security CP 9566 - Change Contract/CD.agent definition and comments

Security CP 9570 - Change AuditEvent.agent definition

• Security CP 9571 Change Provenance.agent definition
• Kathleen did walk through of harmonization map among these Resource "agent" definitions and comments. John explained how the additional fields such as Notes, Requirements, etc. are used.
• WG decided to wait until FM reviews CP 9566 before approving these definitions to make sure that all align before committing to Build.
• Discussed the various approaches to ranking and typing "bags of agents" including situation where the ranking is between a delegator and a delegatee. This impacts approaches to use of a Signature Datatype "who" as a delegatee such as a Device, which cannot be a signer party, to sign on behalf of the legal party. Tabled until next call after issue is reviewed by FM on 2/19 call.