April 3, 2018 Security Conference Call

Back to Security Main Page

Attendees

x	Member Name		x	Member Name		x	Member Name		x	Member Name
x	John Moehrke Security Co-chair		x	Kathleen Connor Security Co-chair		x	Alexander Mense Security Co-chair		.	Trish Williams Security Co-chair
x	Christopher Shawn Security Co-chair		x	Suzanne Gonzales-Webb		x	Mike Davis		.	David Staggs
.	Diana Proud-Madruga		x	Francisco Jauregui		x	Joe Lamy		.	Greg Linden
.	Paul Knapp		.	Grahame Grieve		.	Johnathan Coleman		.	Aaron Seib
.	Ken Salyards		.	Jim Kretz		.	Gary Dickinson		x	Dave Silver
x	Beth Pumo		.	Bo Dagnall		.	Riki Merrick		.	Theresa Connor
.	Mohammed Jafari		.	Ioana Singureanu		.	Peter Bachman		x	[mailto: Matt Blackman, Sequoia]

Back to Security Main Page

Agenda

1. (2 min) Roll Call, Agenda Approval
2. (5 min) Review and Approval of March 27, 2018 minutes
3. (5 min) TF4FA Normative Ballot submitted - Mike
4. (15 min) FHIR Security Updates - John
5. (15 min) Security Cologne May WGM Agenda

• Patient Directed backend communication
  • Zulip chat -https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy/subject/Patient.20directed.20backend.20communication
• Oauth App Registration
  • Zulip chat https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy/subject/OAuth.20App.20Registration
• Certificate Management
  • Zulip chat https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy/subject/Do.20we.20need.20to.20say.20anything.20about.20Certificate.20Management

Meeting Minutes

Roll Call, Agenda Approval Chris Shawn, chair

Roll Call, Agenda Review, Meeting Minutes approval

Meeting Minutes for 3/27/2018

• Motion to approve: (Suzanne/JohnM)
• Objections: none; Abstentions: none; Approval:11 (approved)

TF4FA Normative Ballot - Mike/Kathleen

• Ballot submitted - Mike/Kathleen
• No comments
• Need to confirm this is what intended for the v3 ballot package
  • Brief discussion of the document included
  • This goes to the link with the documents and the .xml file that is used to generate the HTML (PDFS, PSAF v3 Ballot package)
  • Note that CBCP co-chair are listed as co-sponsors
• Kathleen will confirm for the WG that it is ready to go

PSAF weekly calls are cancelled at this time and may restart once ballot reconciliation begins

FHIR Security Updates

• Call just completed - new time is attracting more people
• ZULIP chat has two new streams
  • Security and Privacy stream, additional stream so that only pertinent security and privacy information are conveyed
  • Second stream <<(?) - need>>
• Johnathan Coleman was able to join today’s FHIR Security call
  • Reviewed the key consideration of the ONC white paper
  • Including recommending TLS of 1.2 or higher in place of "TLS" adding some references on why we say 1.2
  • Discussion around input validation and vulnerability assessment and future improvement opportunities

Additional information and links can be found FHIR Security Call: http://wiki.hl7.org/index.php?title=HL7_FHIR_Security_2018-04-03

Agenda for Cologne – Agenda Items Connectathon - JohnM

• FHIR Connectathon track - hopefully, take GDPR as a set of requirements and take the S&P capabilities in and around FHIR--can we show a relationship between them
  • we have provenance resources, can it aid with clause 243 and 398, etc.
  • without going into too much detail, just showing relationships, showing how scenarios prove it... the more we get done the better
  • setting the bar low, trying to get a cross-reference with the S&P items we have
  • in that level we can see that we have a gaping hole that we need to add ... if such a thing exists
  • the other is a less formal, Grahame is interested in standing up a hyper ledger infrastructure (general purpose - block chain infrastructure) for block-chain
  • call out in ZULIP chat, in developing scenario around that type of infrastructure... three different proposes but no fish on the hook

patterns on FHIR

Kathleen received PowerPoint from Rene Spronk

• Rene is working on a GDPR presentation on Healthcare Data Interoperability
• Longer than what we can use for the Q3/Q4 Monday joint,
• Kathleen spoke to Gary Dickenson who thought it might be a good idea for meeting with EHR joint
  • Rene goes through security labels and main parts of GDPR which is required in an automated fashion

• Additional new codes for v3 possible
  • currently have server which can deal with security labels
  • additional information from discussion regarding GDPR/New Codes for v3/Security labels
  • For Connectathon may be able to mock up Purpose of Use of certain kinds of actions involving GDPR
  • Use cases featuring GDPR, Security Labels, etc (suggested)

Next week - Kathleen should have something to present regarding the Cologne agenda Reminder: one of the thoughts was to have a couple of our FHIR security topic areas have prominent spots in the weeklong agenda, for people who would not normally find us...can find us

• JohnM is trying to find what those times areas might be... (for Cologne agenda)
• allowing a block of time would be great to have input from the FHIR WG... for risk management and items like that
• Suggestions requested for topic areas...we can determine where our priorities line up.
• Kathleen noted that the HIMSS GDPR presentation and recording in the meeting material below are excellent for those in US who are wondering how US entities and US citizens in EU may be affected.
• Kathleen also noted that she'd uploaded numerous recent privacy issue links to the "Is Privacy Obsolete" Study Group page
• Meeting call adjorned at 1228 Arizona time --Suzannegw (talk) 15:26, 3 April 2018 (EDT)

Meeting Material and Links

• John Moehrke created new stream for Security and Privacy discussions. Specification development, and Implementation. https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy
• Grahame Grieve created a new stream for Patient Empowerment. Discussions about empowering patients. Focus on deployment and advocacy. https://chat.fhir.org/#narrow/stream/patient.20empowerment
• Proposed FHIR Connectathon track for Cologne -- GDPR Alex has agreed to be a SME. John to support. Rene has agreed to help out. http://wiki.hl7.org/index.php?title=201805_GDPR
• Blockchain FHIR Connectathon Grahame is trying to find a community wanting to 'play' with blockchain. He is willing to standup the infrastructure. See blockchain zulip stream https://chat.fhir.org/#narrow/stream/blockchain
• Trust Framework for Federated Authorization presentation
• TF4FA Vol. 2Behavioral Model May Ballot
• Is Privacy Obsolete Study Group news from EU
• HIMSS - What Healthcare Organizations need to know about the GDPR and HIMSS Presentation recording
• Dutch referendum: Spy tapping powers 'rejected'