HL7 FHIR Security 2016-2-23
Contents
Call Logistics
Weekly: Tuesday at 05:00 EST (2 PM PST)
Conference Audio: 770-657-9270,' Access: 845692
Join online meeting: https://meet.RTC.VA.GOV/suzanne.gonzales-webb/67LLFDYV
If you are having difficulty joining, please try:
https://global.gotomeeting.com/join/520841173
Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes
Back to HL7 FHIR security topics
Attendees
| Member Name | Member Name | Member Name | ||||||
|---|---|---|---|---|---|---|---|---|
| John Moehrke Security Co-Chair | x | Kathleen Connor Security Co-Chair | x | Suzanne Gonzales-Webb CBCC Co-Chair | ||||
| Gary Dickinson EHR Co-Chair | Johnathan ColemanCBCC Co-Chair | Mike Davis | ||||||
| Reed Gelzer RM-ES Lead | x | Glen Marshal | Galen Mulrooney | |||||
| Dave Silver | Rob Horn | x | Judy Fincher | |||||
| Diana Proud-Madruga | [mailto:] | [mailto:] |
Agenda
- Roll; approval of agenda and February 16 minutes
Implement the following changes per 2 new CPs
- CP 1: Align AuditEvent and Provenance action/activity element name and definition. Recommend changing to "activity".
AuditEvent.action [Change to AuditEvent.activity
Question: What to do with the definitional differences - e.g., possibly combine. Current AuditEven.action Definition: Indicator for type of action [Change to "activity".] performed during the event that generated the audit. Control 0..1 Binding AuditEventAction: Indicator for type of action[Change to "activity".] performed during the event that generated the audit. (Required) Type code Requirements This broadly indicates what kind of action [Change to "activity".] was done on the AuditEvent.entity by the AuditEvent.agent.
Definition: An activity is something that occurs over a period of time and acts upon or with entities; it may include consuming, processing, transforming, modifying, relocating, using, or generating entities. Control 0..1 Binding ProvenanceEventCurrentState: The activity that took place. (Extensible) Type Coding
- CP 9417: Add to [http://hl7-fhir.github.io/provenance.html Provenance Resource a new Provenance.entity.lifecycle element to align with Audit.entity.lifecycle.
Current Audit.entity.lifecycle Definition Identifier for the data life-cycle stage for the entity. Control 0..1 Binding AuditEventObjectLifecycle: Identifier for the data life-cycle stage for the object. (Extensible) Type Coding Requirements Institutional policies for privacy and security may optionally fall under different accountability rules based on data life cycle. This provides a differentiating value for those cases. Comments This can be used to provide an audit trail for data, over time, as it passes through the system."
- Discuss the various approaches to ranking and typing "bags of agents" including situation where the ranking is between a delegator and a delegatee. This impacts approaches to use of a Signature Datatype "who" as a delegatee such as a Device, which cannot be a signer party, to sign on behalf of the legal party. Tabled until next call after issue is reviewed by FM on 2/19 call.
- Discussion items that are possibly ready for a vote.
- 9407 Align AuditEvent and Provenance action/activity element. Recommend "Provenance.entity.activity". (Kathleen Connor) None
- 9417 Add a new Provenance.entity.lifecycle element to align with Audit.entity.lifecycle. Align definitions. (Kathleen Connor) None
- 9562 Change Signature Datatype - make blob 0..1 (Kathleen Connor) None
- 9570 Change AuditEvent.agent definitions (Kathleen Connor) None
- 9571 Change Provenance.agent definition (Kathleen Connor) None
- 9593 Improve advice for Access Denied response (John Moehrke) None
Minutes
- Discussed the various approaches to ranking and typing "bags of agents"....
