This wiki has undergone a migration to Confluence found Here
<meta name="googlebot" content="noindex">

Difference between revisions of "HL7 WGM May 2015 - Paris, France - Security WG - Minutes"

From HL7Wiki
Jump to navigation Jump to search
Line 78: Line 78:
 
Stefano Lotti (SOA)  
 
Stefano Lotti (SOA)  
 
Zachary Huynh
 
Zachary Huynh
 +
 +
=Wednesday Q3 =
 +
Ballot comments related to FHIR
 +
 +
Josh Mandel
 +
Argonaut is a collaboration between EHR and clinical care providers, to develop open specifications  - in particular for FHIR. Security protocols associated with these?   
 +
SMART on FHIR (Boston's Children's Hospital) on FHIR project is looking at single sign on using mobile and web apps using OAuth2 and OpenIDConnect. http://smarthealthit.org/ and http://docs.smarthealthit.org/

Revision as of 12:52, 13 May 2015

Minutes from Security WG

Tuesday Q1

  • Attendee
    • John Moehrke - Co-Chair
    • Alex Mense - Co-Chair
    • Miyohara, Hideyuki
    • Jonathan Coleman
    • Clay Sebourn - Clay.Sebourn@emc.com
    • NOT! Princess Trish Williams - Co-Chair


Tuesday Q2

  • Attendee
    • John Moehrke - Co-Chair
    • Alex Mense - Co-Chair
    • Miyohara, Hideyuki
    • Jonathan Coleman
    • Clay Sebourn - Clay.Sebourn@emc.com
    • Trish Williams - Co-Chair
    • Jeff Ting - Jeffery.Ting@SystemsMadeSimple.com
    • Comelia Felder - comelia.felder@roche.com
  • Privacy on FHIR - Jonathan Coleman
    • ONC and VA initiative to demonstrate Privacy on FHIR
    • Not an effort to create standards or guidance documentation
    • Using HCS, SLS, Ontology, DS4P, and consent
    • OpenID, OAuth2, UMA
  • Data Provenance IG - Jonathan Coleman
    • comments resolved awaiting final DSTU soon
  • FHIR Ballot triage

Tuesday Q3

  • FHIR Ballot triage

Tuesday Q4

lack of quorum, canceled

Wednesday Q2

  • Joint with SOA (hosted by SEC)
  • PASS Access Control. Addresses the information and capabilities required to provide Access Control service to protect resources in a distributed healthcare environment, where interoperability requirements exist.
  • Current status of PASS is DSTU (but out of date) it will go forward to Normative Ballot Sept 2015.
    • Under consideration is a Platform Specific Model targeting FHIR resource access management. SEC should take the lead, and get a project lead for this. Need to understand the Argonaut project content on security. Are they leveraging PASS. Clarification from Josh Mandel will be sought.
      • Under a Platform Specific Model this would require specification of the security token platform?
      • RESTful API already can use/does use PASS. The application in healthcare further includes patient consent and additional context specific attributes.
      • For instance, Privacy on FHIR (VA/ONC US specific) demonstrates the use of standard tools to apply to healthcare including PASS; SMART initiative uses PASS; and Argonaut project using it? HEART (OAuth, OpenID Connect, and UMA committees) to come to healthcare to help healthcare - John M engaging with this.
      • PASS Access control specific to FHIR. This should be constrained further to a specific interaction model (SOAP, V2 messaging, CDA, transactions, etc).
    • Suggested to also go into normative ballot is the use of FHIR Security/Privacy related Resources as Access Decision Information (ACI) sources for Privacy Enforcement Point (PEP) realizations. This is a clarifier of the Platform Specific Model(discussed above)
  • Security will find lead (from those working on the problem). The project will not be created until the people are found.
  • PSS on Approved at TSC 12/05/2015
    • Project Summary for HL7 Privacy and Security Architecture Framework [PSAF aka 'Privacy Safe'].

Attendees: Trish Williams - Co-Chair John Moehrke - Co-Chair Alex Mense - Co-Chair Miyohara, Hideyuki Clay Sebourn - Clay.Sebourn@emc.com Jeff Ting - Jeffery.Ting@SystemsMadeSimple.com Vince McCauley (SOA) Stefano Lotti (SOA) Zachary Huynh

Wednesday Q3

Ballot comments related to FHIR

Josh Mandel Argonaut is a collaboration between EHR and clinical care providers, to develop open specifications - in particular for FHIR. Security protocols associated with these? SMART on FHIR (Boston's Children's Hospital) on FHIR project is looking at single sign on using mobile and web apps using OAuth2 and OpenIDConnect. http://smarthealthit.org/ and http://docs.smarthealthit.org/

Retrieved from "https://wiki.hl7.org/w/index.php?title=HL7_WGM_May_2015_-_Paris,_France_-_Security_WG_-_Minutes&oldid=100009"