HL7 FHIR Security 2016-2-23

Call Logistics

Weekly: Tuesday at 05:00 EST (2 PM PST)

Conference Audio: 770-657-9270,' Access: 845692

Join online meeting: https://meet.RTC.VA.GOV/suzanne.gonzales-webb/67LLFDYV

If you are having difficulty joining, please try:

https://global.gotomeeting.com/join/520841173

Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes

Back to HL7 FHIR security topics

Attendees

	Member Name			Member Name			Member Name
x	John Moehrke Security Co-Chair		x	Kathleen Connor Security Co-Chair		x	Suzanne Gonzales-Webb CBCC Co-Chair
x	Gary Dickinson EHR Co-Chair		.	Johnathan ColemanCBCC Co-Chair		.	Mike Davis
.	Reed Gelzer RM-ES Lead		x	Glen Marshal		.	Galen Mulrooney
.	Dave Silver		x	Rob Horn		.	Judy Fincher
x	Diana Proud-Madruga		x	Beth Pumo		.	[mailto:]

Agenda

• Roll; approval of agenda and February 16 minutes
• CP 6303
• FHIR P&S Resource Element Harmonization map

Implement the following changes per 2 new CPs

• CP 1: Align AuditEvent and Provenance action/activity element name and definition. Recommend changing to "activity".

AuditEvent.action [Change to AuditEvent.activity

Question: What to do with the definitional differences - e.g., possibly combine. Current AuditEven.action Definition: Indicator for type of action [Change to "activity".] performed during the event that generated the audit. Control 0..1 Binding AuditEventAction: Indicator for type of action[Change to "activity".] performed during the event that generated the audit. (Required) Type code Requirements This broadly indicates what kind of action [Change to "activity".] was done on the AuditEvent.entity by the AuditEvent.agent.

• Provenance.activity

Definition: An activity is something that occurs over a period of time and acts upon or with entities; it may include consuming, processing, transforming, modifying, relocating, using, or generating entities. Control 0..1 Binding ProvenanceEventCurrentState: The activity that took place. (Extensible) Type Coding

• CP 9417: Add to [http://hl7-fhir.github.io/provenance.html Provenance Resource a new Provenance.entity.lifecycle element to align with Audit.entity.lifecycle.

Current Audit.entity.lifecycle Definition Identifier for the data life-cycle stage for the entity. Control 0..1 Binding AuditEventObjectLifecycle: Identifier for the data life-cycle stage for the object. (Extensible) Type Coding Requirements Institutional policies for privacy and security may optionally fall under different accountability rules based on data life cycle. This provides a differentiating value for those cases. Comments This can be used to provide an audit trail for data, over time, as it passes through the system."

• Discuss the various approaches to ranking and typing "bags of agents" including situation where the ranking is between a delegator and a delegatee. This impacts approaches to use of a Signature Datatype "who" as a delegatee such as a Device, which cannot be a signer party, to sign on behalf of the legal party. Tabled until next call after issue is reviewed by FM on 2/19 call.

• Discussion items that are possibly ready for a vote.
• 9407 Align AuditEvent and Provenance action/activity element. Recommend "Provenance.entity.activity". (Kathleen Connor) None
• 9417 Add a new Provenance.entity.lifecycle element to align with Audit.entity.lifecycle. Align definitions. (Kathleen Connor) None
• 9570 Change AuditEvent.agent definitions (Kathleen Connor) None
• 9571 Change Provenance.agent definition (Kathleen Connor) None
• 9562 Change Signature Datatype - make blob 0..1 (Kathleen Connor) None
• 9593 Improve advice for Access Denied response (John Moehrke) None

Minutes

• Discussion on the various approaches to modeling delegation deferred.
• Kathleen to update Agent CP 9570, 9571with revised definitions
• Kathleen to update this group on outcome of FM discussion on
• John to organize block vote for next Tuesday March 1 call.
• Kathleen to continue work on an aligned definition for activity, as well as other definitions in the cross FHIR S&P alignment spreadsheet.