This wiki has undergone a migration to Confluence found Here
<meta name="googlebot" content="noindex">

Difference between revisions of "April 3, 2018 Security Conference Call"

From HL7Wiki
Jump to navigation Jump to search
Line 77: Line 77:
 
Roll Call, Agenda Review, Meeting Minutes approval
 
Roll Call, Agenda Review, Meeting Minutes approval
  
Meeting Minutes for 3/27/2018
+
[http://wiki.hl7.org/index.php?title=March_27,_2018_Security_Conference_Call Meeting Minutes for 3/27/2018]
Motion to approve: (Suzanne/JohnM)
+
* Motion to approve: (Suzanne/JohnM)
objections: none; abstentions: none; approval:11 (approved)
+
* Objections: none; Abstentions: none; Approval:11 (approved)
  
 
'''TF4FA Normative Ballot''' - Mike/Kathleen
 
'''TF4FA Normative Ballot''' - Mike/Kathleen
* ballot submitted - Mike/Kathleen
+
* Ballot submitted - Mike/Kathleen
 
* No comments
 
* No comments
 
* Need to confirm this is what intended for the v3 ballot package
 
* Need to confirm this is what intended for the v3 ballot package
Line 90: Line 90:
 
* Kathleen will confirm for the WG that it is ready to go
 
* Kathleen will confirm for the WG that it is ready to go
  
PSAF weekly calls are cancelled at this time and may restart once ballot reconciliation begins
+
''PSAF weekly calls are cancelled at this time and may restart once ballot reconciliation begins''
  
FHIR Security Updates
+
'''FHIR Security Updates'''
* call just completed - new time is attracting more people
+
* Call just completed - new time is attracting more people
 
* ZULIP chat has two new streams
 
* ZULIP chat has two new streams
** security and privacy stream, additional stream so that only pertinent security and privacy information are conveyed  
+
** Security and Privacy stream, additional stream so that only pertinent security and privacy information are conveyed  
** ** another stream (?)
+
** Second stream <<(?) - need>>
* Johnathan was able to join today’s call, reviewed the key consideration of the ONC white paper
+
* Johnathan Coleman was able to join today’s FHIR Security call
** recommend TL@ 1.2 or high in place of just "TLS" adding some references on why we say 1.2
+
** Reviewed the key consideration of the ONC white paper
** discussion around input validation and vulnerability assessment and future improvement opportunities
+
** Including recommending ''TLS of 1.2 or higher'' in place of "TLS" adding some references on why we say 1.2
 +
** Discussion around input validation and vulnerability assessment and future improvement opportunities
  
Add information from FHIR Security Call
+
Additional information and links can be found FHIR Security Call:  http://wiki.hl7.org/index.php?title=HL7_FHIR_Security_2018-04-03
  
Connectathon -  
+
'''Agenda for Cologne – Agenda Items'''
FHIR Connectathon track - hopefully, take GDPR as a set of requirements and take the S&P capabilities in and around FHIR--can we show a relationship between them
+
Connectathon - JohnM
* we have provenance resources, can it aid with clause 243 and 398, etc.
+
* FHIR Connectathon track - hopefully, take GDPR as a set of requirements and take the S&P capabilities in and around FHIR--can we show a relationship between them
* without going into too much detail, just showing relationships, showing how scenarios prove it... the more we get done the better
+
** we have provenance resources, can it aid with clause 243 and 398, etc.
*setting the bar low, trying to get a cross-reference with the S&P items we have
+
** without going into too much detail, just showing relationships, showing how scenarios prove it... the more we get done the better
* in that level we can see that we have a gaping hole that we need to add ... if such a thing exists
+
** setting the bar low, trying to get a cross-reference with the S&P items we have
 +
** in that level we can see that we have a gaping hole that we need to add ... if such a thing exists
 +
** the other is a less formal, Grahame is interested in standing up a hyper ledger infrastructure (general purpose - ''block chain infrastructure'') for block-chain
 +
** call out in ZULIP chat, in developing scenario around that type of infrastructure... three different proposes but no ''fish on the hook''
  
* the other is a less formal, Grahame is interested in standing up a hyper ledger infrastructure (general purpose - ''block chain infrastructure'') for block-chain
 
* call out in ZULIP chat, in developing scenario around that type of infrastructure... three different proposes but no ‘’fish on the hook’’
 
*
 
 
‘’’Agenda for Cologne – Agenda Items’’’
 
 
patterns on FHIR  
 
patterns on FHIR  
  
Kathleen received xx from Rene Spronk
+
Kathleen received PowerPoint from Rene Spronk
* he is working on a '''GDPR presentation on healthcare data interoperability''' - on vocab we might need,
+
* Rene is working on a '''GDPR presentation on Healthcare Data Interoperability'''  
* longer than what we can use for the Q3/Q4 Monday joint,  
+
* Longer than what we can use for the Q3/Q4 Monday joint,  
 
* Kathleen spoke to Gary Dickenson who thought it might be a good idea for meeting with EHR joint
 
* Kathleen spoke to Gary Dickenson who thought it might be a good idea for meeting with EHR joint
 
** Rene goes through security labels and main parts of GDPR which is required in an automated fashion
 
** Rene goes through security labels and main parts of GDPR which is required in an automated fashion
  
* possible new codes for v3
+
* Additional new codes for v3 possible
** have server which can deal with security labels
+
** currently have server which can deal with security labels
**maybe able to mock up POU, certain kinds of actions, involving GDPR
+
** additional information from discussion regarding GDPR/New Codes for v3/Security labels
** use cases featuring GDPR, SL, etc (suggested)
+
** For Connectathon may be able to mock up Purpose of Use of certain kinds of actions involving GDPR
 +
** Use cases featuring GDPR, Security Labels, etc (suggested)
  
 
Next week - Kathleen should have something to present regarding the Cologne agenda
 
Next week - Kathleen should have something to present regarding the Cologne agenda
reminder: one of the thoughts was to have a couple of our FHIR security topic areas have prominent spots in the weeklong agenda, for people who would not normally find us...can find us
+
Reminder: one of the thoughts was to have a couple of our FHIR security topic areas have prominent spots in the weeklong agenda, for people ''who would not normally find us...can find us''
* JohnM is trying to find what those times areas might be... (for cologne agenda)
+
* JohnM is trying to find what those times areas might be... (for Cologne agenda)
* l*block of time...would be great to have input from the FHIR WG... risk management and items like that
+
* allowing a block of time would be great to have input from the FHIR WG... for risk management and items like that
*suggestions requested for topic areas...we can determine where our priorities line up.  
+
* Suggestions requested for topic areas...we can determine where our priorities line up.  
  
  
 +
'''Additional items?'''
  
Additional items?
 
'''
 
 
in materials, Kathleen adds salient information to meeting minutes -  
 
in materials, Kathleen adds salient information to meeting minutes -  
 
* look at changes to ... so that you have a navigating
 
* look at changes to ... so that you have a navigating
privacy obsolete - added links, to breaches, breaches to be considered in court, surveillance techniques, etc. related to privacy issues
+
* privacy obsolete - added links, to breaches, breaches to be considered in court, surveillance techniques, etc. related to privacy issues
 
the HIMSS presentation on GDPR is excellent if you want to have a sense on what US entities might be interested on... may have interest
 
the HIMSS presentation on GDPR is excellent if you want to have a sense on what US entities might be interested on... may have interest
  
 
+
Meeting call adjorned at 1228 Arizona time --[[User:Suzannegw|Suzannegw]] ([[User talk:Suzannegw|talk]]) 15:26, 3 April 2018 (EDT)
meeting call adjorned at 1228 Arizona time --[[User:Suzannegw|Suzannegw]] ([[User talk:Suzannegw|talk]]) 15:26, 3 April 2018 (EDT)
 

Revision as of 04:51, 4 April 2018

Back to Security Main Page

Attendees

x Member Name x Member Name x Member Name x Member Name
x John Moehrke Security Co-chair x Kathleen Connor Security Co-chair x Alexander Mense Security Co-chair . Trish Williams Security Co-chair
x Christopher Shawn Security Co-chair x Suzanne Gonzales-Webb x Mike Davis . David Staggs
. Diana Proud-Madruga x Francisco Jauregui x Joe Lamy . Greg Linden
. Paul Knapp . Grahame Grieve . Johnathan Coleman . Aaron Seib
. Ken Salyards . Jim Kretz . Gary Dickinson x Dave Silver
x Beth Pumo . Bo Dagnall . Riki Merrick . Theresa Connor
. Mohammed Jafari . Ioana Singureanu . Peter Bachman x [mailto: Matt Blackman, Sequoia]

Back to Security Main Page

Agenda

  1. (2 min) Roll Call, Agenda Approval
  2. (5 min) Review and Approval of March 27, 2018 minutes
  3. (5 min) TF4FA Normative Ballot submitted - Mike
  4. (15 min) FHIR Security Updates - John
  5. (15 min) Security Cologne May WGM Agenda

Meeting Materials


Meeting Minutes DRAFT

Roll Call, Agenda Approval Chris Shawn, chair

Roll Call, Agenda Review, Meeting Minutes approval

Meeting Minutes for 3/27/2018

  • Motion to approve: (Suzanne/JohnM)
  • Objections: none; Abstentions: none; Approval:11 (approved)

TF4FA Normative Ballot - Mike/Kathleen

  • Ballot submitted - Mike/Kathleen
  • No comments
  • Need to confirm this is what intended for the v3 ballot package
    • Brief discussion of the document included
    • This goes to the link with the documents and the .xml file that is used to generate the HTML (PDFS, PSAF v3 Ballot package)
    • Note that CBCP co-chair are listed as co-sponsors
  • Kathleen will confirm for the WG that it is ready to go

PSAF weekly calls are cancelled at this time and may restart once ballot reconciliation begins

FHIR Security Updates

  • Call just completed - new time is attracting more people
  • ZULIP chat has two new streams
    • Security and Privacy stream, additional stream so that only pertinent security and privacy information are conveyed
    • Second stream <<(?) - need>>
  • Johnathan Coleman was able to join today’s FHIR Security call
    • Reviewed the key consideration of the ONC white paper
    • Including recommending TLS of 1.2 or higher in place of "TLS" adding some references on why we say 1.2
    • Discussion around input validation and vulnerability assessment and future improvement opportunities

Additional information and links can be found FHIR Security Call: http://wiki.hl7.org/index.php?title=HL7_FHIR_Security_2018-04-03

Agenda for Cologne – Agenda Items Connectathon - JohnM

  • FHIR Connectathon track - hopefully, take GDPR as a set of requirements and take the S&P capabilities in and around FHIR--can we show a relationship between them
    • we have provenance resources, can it aid with clause 243 and 398, etc.
    • without going into too much detail, just showing relationships, showing how scenarios prove it... the more we get done the better
    • setting the bar low, trying to get a cross-reference with the S&P items we have
    • in that level we can see that we have a gaping hole that we need to add ... if such a thing exists
    • the other is a less formal, Grahame is interested in standing up a hyper ledger infrastructure (general purpose - block chain infrastructure) for block-chain
    • call out in ZULIP chat, in developing scenario around that type of infrastructure... three different proposes but no fish on the hook

patterns on FHIR

Kathleen received PowerPoint from Rene Spronk

  • Rene is working on a GDPR presentation on Healthcare Data Interoperability
  • Longer than what we can use for the Q3/Q4 Monday joint,
  • Kathleen spoke to Gary Dickenson who thought it might be a good idea for meeting with EHR joint
    • Rene goes through security labels and main parts of GDPR which is required in an automated fashion
  • Additional new codes for v3 possible
    • currently have server which can deal with security labels
    • additional information from discussion regarding GDPR/New Codes for v3/Security labels
    • For Connectathon may be able to mock up Purpose of Use of certain kinds of actions involving GDPR
    • Use cases featuring GDPR, Security Labels, etc (suggested)

Next week - Kathleen should have something to present regarding the Cologne agenda Reminder: one of the thoughts was to have a couple of our FHIR security topic areas have prominent spots in the weeklong agenda, for people who would not normally find us...can find us

  • JohnM is trying to find what those times areas might be... (for Cologne agenda)
  • allowing a block of time would be great to have input from the FHIR WG... for risk management and items like that
  • Suggestions requested for topic areas...we can determine where our priorities line up.


Additional items?

in materials, Kathleen adds salient information to meeting minutes -

  • look at changes to ... so that you have a navigating
  • privacy obsolete - added links, to breaches, breaches to be considered in court, surveillance techniques, etc. related to privacy issues

the HIMSS presentation on GDPR is excellent if you want to have a sense on what US entities might be interested on... may have interest

Meeting call adjorned at 1228 Arizona time --Suzannegw (talk) 15:26, 3 April 2018 (EDT)