HL7 FHIR Security 2018-07-31

Call Logistics

Weekly: Tuesday at 02:00 pm EST

Web conference desktop and VOIP https://www.freeconferencecall.com/join/security36 
Online Meeting ID: security36
Phone: +1 515-604-9567, Participant Code: 880898
 Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes 

Back to HL7 FHIR security topics

Attendees

	Member Name			Member Name			Member Name
x	John Moehrke Security Co-Chair		x	Kathleen Connor Security Co-Chair		.	Alexander Mense Security Co-chair
x	Suzanne Gonzales-Webb CBCC Co-Chair		.	Johnathan Coleman CBCC co-chair		.	Chris Shawn Security co-chair
x	Jim Kretz		x	Kenneth Salyards		.	Nathan Botts Mobile co-chair
.	Diana Proud-Madruga		x	Joe Lamy AEGIS		x	Beth Pumo
.	Irina Connelly		.	Matt Blackman Sequoia		x	Mark Underwood NIST
.	Peter Bachman		.	Grahame Greve FHIR Program Director		.	Kevin Shekleton (Cerner, CDS Hooks)
x	Luis Maas		.	Julie Mass		.	Francisco Jauregui
.	Gary Dickinson		.	Dave Silver		.	Foo Bar

Agenda

• Roll;
• approval of agenda
• approval of HL7 FHIR Security 2018-07-10 Minutes
• Announcements
  • TBD
  • Baltimore Connectathon?
  • Deadline for substantive changes to R4 -- 2018-08-10
• Is there any quality issues with last set of CR applied to build -- http://build.fhir.org
• Review Kathleen's proposal for Safety Checklist
  • Feedback for Safety Checklist
• Block Vote
• All security open http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemBrowse&tracker_id=677&tracker_query_id=4967
• New business

Block Vote

• 17422 Mandatory+floor+of+TLS+1.2 (Johnathan Coleman) Not Persuasive
• 16051 Provenance%3A+inconsistant+description+of+the+W3C+model (Francois Macary) Persuasive
• 17449 signatures.html+should+mention+need+for+input%2C+wiki+page+with+issues%2C+and+point+at+Signature+datatype (John Moehrke) Persuasive
• 17465 Signature+who%5Bx%5D+and+onBehalfOf%5Bx%5D+can+be+simplified+to+just+Reference+types (John Moehrke) Persuasive
• 17466 Signature.blob+should+be+a+more+useful+element+name.+Recommend+rename+to+.evidence (John Moehrke) Persuasive
• 17506 Provenance.agent.type+valueset+needs+HL7+participation+types (John Moehrke) Persuasive
• 13827 Is+there+something+more+secure+than+%22SHOULD+use+CORS%22 (Keith Boone) Persuasive with Mod

references

• stream for Security and Privacy discussions. Specification development, and Implementation.
  • https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy
• stream for Patient Empowerment. Discussions about empowering patients. Focus on deployment and advocacy.
  • https://chat.fhir.org/#narrow/stream/patient.20empowerment
• Proposed FHIR Connectathon track for Cologne -- GDPR
  • http://wiki.hl7.org/index.php?title=201805_GDPR
• Blockchain FHIR Connectathon
  • Grahame is trying to find a community wanting to 'play' with blockchain. He is willing to standup the infrastructure.
  • See blockchain zulip stream https://chat.fhir.org/#narrow/stream/blockchain
• Certificate Management
  • Zulip chat https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy/subject/Do.20we.20need.20to.20say.20anything.20about.20Certificate.20Management
• TLS 1.2 or higher
  • https://chat.fhir.org/#narrow/stream/111-Security-and.20Privacy/topic/TLS.201.2E2.20or.20higher
• Improvement beyond SMART scopes
  • Zulip chat https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy/subject/Improvement.20beyond.20SMART.20scopes
• Patient Directed backend communication
  • Zulip chat https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy/subject/Patient.20directed.20backend.20communication
• Oauth App Registration
  • Zulip chat https://chat.fhir.org/#narrow/stream/Security.20and.20Privacy/subject/OAuth.20App.20Registration

Minutes

• John Chaired
• Minutes approved unanimously
• Currently there is not a FHIR Connectathon track
  • Kathleen indicates that we should check with Alex as she thinks there are some europeans coming with an expectation of testing
• Block vote
  • Motion Kathleen Connor/Jim Kretz: 4-0-0
• Discussion of Kathleen's proposal for safetychecklist
  • GO with the second security section proposal
  • ACTION: Kathleen to finish all 'ticklers'. The checklist could mention each concept that we go into depth on the security html pages. No depth, but rather point over to the depth on those pages.
• Adjourn 30 minutes