HL7 FHIR Security 2015-12-15

Back to HL7 FHIR security topics

Attendees

	Member Name			Member Name			Member Name
	John Moehrke Security Co-Chair			Kathleen Connor			Suzanne Gonzales-Webb CBCC Co-Chair
	Gary Dickinson EHR Co-Chair			Johnathan ColemanCBCC Co-Chair			Judy Fincher
	Reed Gelzer RM-ES Lead			Glen Marshal			Galen Mulrooney
	Dave Silver			[1]			[2]

Agenda

• Should we cancel next week?

To Discuss

• 9128 Provenance.agent should be required. Change to 1..* from 0..* (John Moehrke) None
• 9105 Change Provenance.activity to coding and bind to FHIR ProvenanceEvent value set. (Kathleen)
• 9078 HTTP Caching Warning for FHIR GET REST services (Kathleen Connor) None
• 8638 how does Provenance work when deleting records (Grahame Grieve) None
• 7597 2015May core #888 - This resource is missing any reference to the "action" performed on the entity. Is there a default "create" action or is it an omission? (Ioana Singureanu)
• 9036 Handling of meta values that should force version, such as security_labels (John Moehrke) None
• 9037 Security page should recognize HEART (John Moehrke) None
• 8790 Give guidance on AuditEvent that codes don't need DisplayName populated (Paul Knapp) None

Related to RBAC

• 3318 Clarify how to use RBAC and ABAC using FHIR (John Moehrke) Considered for Future Use

Awaiting vocabulary

• Review ProvenanceEvent value set
• 9051 Remove AuditEvent.participant.role binding to http://hl7.org/fhir/ValueSet/dicm-402-roleid. Bind this value set to AuditEvent.particpant.userid (Kathleen Connor) None
• 9042 Add RBAC as value set for AuditEvent.participant.role (Kathleen Connor) None
• 9043 Add ABAC as alternative value set for AuditEvent.participant.role (Kathleen Connor) None
• 9052 Add SNOMED Stuctural Roles as value set for AuditEvent.participant.role (Kathleen Connor) None
• 6303 Add Record Lifecycle Events to AuditEventObjectLifecycle Set (Gary Dickinson) Considered for Future Use

Other Provenance

• 7563 2015May core #854 - Expand on how to use Provenance (Kathleen Connor) Considered for Future Use
• 7567 2015May core #858 - Provenance isn't sufficiently aligned with w3c spec (Kathleen Connor) Considered for Future Use
• 7568 2015May core #859 - How are agent and activity linked? (Kathleen Connor) Considered for Future Use
• 7569 2015May core #860 - Clarify relationship agents and entities used in activity (Kathleen Connor) Considered for Future Use
• 7570 2015May core #861 - Clarify relationship agents and entities used in activity (Kathleen Connor) Considered for Future Use
• 8803 Provenance for a subset of a resource (Chris Grenz) None

Other Signature

• 8731 Canonicalization for signatures (Lloyd McKenzie) None
• 8827 Signature datatype does not include counter-signature type (John Moehrke) None
• 7752 2015May core #1073 - Replace value set with FHIR Signer Type value set (Kathleen Connor) Not Related

Other

We have "Open Issues and Request for Comments" on AuditEvent and on Provenance. These need to be cleaned up by the DSTU 2.1 ballot time. This is mostly a narrative of the CPs we had open at the DSTU2 ballot time, so by closing the above CPs we likely close these TODO, and thus could eliminate these sections.

• 9150 Provenance TODO section cleanup
• 9151 AuditEvent has TODO section to be removed