December 12, 2017 Security Conference Call

Back to Security Main Page

Attendees

x	Member Name		x	Member Name		x	Member Name		x	Member Name
x	John Moehrke Security Co-chair		x	Kathleen Connor Security Co-chair		x	Alexander Mense Security Co-chair		.	Trish Williams Security Co-chair
	Christopher Shawn Security Co-chair		x	Suzanne Gonzales-Webb		x	Mike Davis		x	David Staggs
.	Mohammed Jafari		.	Beth Pumo		.	Ioana Singureanu		.	Rob Horn
x	Diana Proud-Madruga		.	Serafina Versaggi		x	Joe Lamy		.	Greg Linden
.	Paul Knapp		.	Grahame Grieve		.	Johnathan Coleman		.	Aaron Seib
.	Ken Salyards		.	Jim Kretz		.	Gary Dickinson		x	Dave Silver
.	Oliver Lawless		.	Lisa Nelson		.	David Tao		.	Nathan Botts

Back to Security Main Page

Agenda

1. (2 min) Roll Call, Agenda Approval
2. (3 min) Review and Approval of December 5, 2017 minutes
3. (30 min) Next week - Using Biometrics for Patient Matching - Healthcare Privacy and Security Considerations. Discussion with Privacy Attorney Expert, Devon Connor-Green.
4. (5 min) Update on progress of Consumer Centered Data Exchange Connectathon scenario with Cascading Authorized App acting "on behalf of" a patient. Jan 2018 FHIR Connectathon CCDE Sequence Diagram and Walk-through - Kathleen and Mohammad
5. (5 min) PSAF call report out on HL7 Security and Privacy Domain Model - Mike Davis and Chris Shawn
6. (5 min) Is Privacy Obsolete? Study Group wiki page has the "Is Privacy Obsolete?" Listserve link. Update on project - Mike Davis and Chris Shawn
7. (5 min) GOM Change vote
8. (5 min) FHIR Security update Call later? - John Moehrke

Minutes

• Alex chaired.
• Agenda approved. Kathleen moved, Mike seconded. 8-0-0
• Minutes from December 5th reviewed. Minute Approval: Mike moved; Kathleen seconded. Approved: 6-0-2.
• RE: Using Biometrics for Patient Matching - Healthcare Privacy and Security Consierations. Devon Connor-Green gave a thorough presentation on current state of biometric application and cloud services generally and in healthcare specifically. Covered the technology and privacy issues including US state laws and GDRP. Gave several US healthcare applications including patient authentication and patient matching, and provided stats on cost saving potential for automated over manual correction of duplicate or uncertain patient matches. Provided insight into privacy and security risks, HIPAA questions related to whether even algorithically transformed biometrics are considered de-identified under HIPAA Privacy rule. Provided potential security and privacy controls that could mitigate risks.
• RE: Consumer Centered Data Exchange Connectathon scenario with Cascading Authorized App acting "on behalf of" a patient. - Kathleen gave a quick update on current efforts to address privacy issues related to letting Apps have access to all Resource Servers that contain a patient's records.
• RE: PSAF call report out - Mike reported on earlier call for PSAF and with CBCP regarding preparations for May 2018 ballot. Plans are to do indepth discussion of DAM updates on CBCP calls.
• RE: Updates to Is Privacy Obsolete? Study Group wiki page - Mike discussed his research and analysis of recent breaches especially in US, e.g., the OPM breach, and the court findings to date.
• RE GOM Change vote - Kathleen asked that the WG confirm a changed recommendation to support the revision to required deviations from standard Decision Making Practice to be sent through TSC as this may be more efficient given regular updates to the DMP standards to which all WGs must resubmit their changes, even if only adopting new update. WG agreed to modification of previous comments. Kathleen to submit to HQ on WG's behalf.
• RE: FHIR Security call report out - John wants to know who will attend in order to decide whether to hold the call since most CRs for the upcoming For Comment ballot have been resolved. Kathleen to let him know.

Meeting Materials

RE GOM Change vote recommendations:

• Changed Recommendation - Vote to approve WI1709004 Variations from standard DMP - Proposal to stipulate that deviations from the standard/common DMP shall be approved by the TSC. During FM discussion, Mary Kay and Andy Stechishin pointed out that whenever a WG’s DMP changes, they have to be approved by the WG’s Steering Division. So whenever the standard DMP has been updated, all the WGs have to make changes to their DMPs, and have them approved. The proposed change would eliminate the need for WGs who simply adopt the current standard DMPs to have them approved. Only those WGs whose DMPs vary from an update to the standard DMP would need approval by TSC, rather than their Steering Divisions, going forward. This would lower administrative overhead.
• Vote negative on WI1709002 Non-member participation in User Groups - Implementation of EC decision to limit non-member participation to one-year. Need rationale for what appears to be a barrier to participation. Note, this pertains to User Groups, not Work Groups.
• Vote to approve WI1709003 Revise resolution of motions by email - Proposal from the CTO to allow submission of email vote on electronic motion (§06.06) to either the list or directly to the Secretary.
• Vote to approve WI1709004 Variations from standard DMP - Proposal to stipulate that deviations from the standard/common DMP shall be approved by the TSC.
• Vote to approve WI1709005 Electronic voting for WG co-chair elections - Implementation of electronic voting for WG co-chair elections piloted at September WGM
• Vote to approve WI1709006 Revise Contract Work process - Implementation of revisions to Contract Work process prepared by EC task force.

Updates to Is Privacy Obsolete Study Group Wiki

• "Is Privacy Obsolete" Study Group Page"
• Breaches References
• Breaches Spreadsheet