This wiki has undergone a migration to Confluence found Here
<meta name="googlebot" content="noindex">

HL7 FHIR security topics

From HL7Wiki
Jump to navigation Jump to search

Back to Security Main Page

Call Logistics

Weekly: Tuesday at 2:00pm Eastern Time
Web conference desktop and VOIP https://www.freeconferencecall.com/join/security36 
Online Meeting ID: security36
Phone: +1 515-604-9567, Participant Code: 880898
Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes

Scope: Develop and Maintain FHIR Security Resources

Project ID 1209

This project will identify and define resources, terminology, profiles, extensions as well as security label metadata necessary to support Healthcare Security and Privacy requirements.

These requirements include those identified by international domains as articulated in legislation, policy, related standards, and those documented in HL7 Privacy and Security related domain analysis, architectural frameworks, services, and functional models, and various v2, v3, CDA, and FHIR interchange specifications. Specifically, this includes the AuditEvent resource, Provenance resource, Signature datatype, assigned to Security by the FMG as well as profiles and implementation guides created against these resources.

The development and maintenance of these artifacts will be conducted in collaboration with other relevant domain work groups as outlined in the Security WG mission and charter.

The Security WG will develop guidance regarding use of HL7 Security Standards (e.g. Role and Attribute-based access controls and vocabularies. In addition, the Security WG will work with appropriate external standards organizations to develop appropriate guidance on the use of general purpose security technologies, such as user authentication and authorization, that would aid with the secure and privacy protecting use of FHIR; and guide the FHIR community on the appropriate use of these solutions through the security pages of the FHIR specification, assigned to Security WG by the FMG.


Agenda and Minutes

Export from Gforge Security Open

FHIR disposition link on gForge for review/discussion (ongoing weekly agenda item)

John moved the items from November 3rd, 2015 gForge export and distributed them to the various parts: Provenance, AuditEvent, Security pages, and Signature.

Provenance

HL7 FHIR Provenance Resource Project Work

AuditEvent

HL7 FHIR AuditEvent Resource Project Work

Security Pages

  • Security pages
    • Including guidance on Authentication and Authorization
    • Security Labels Page
      • including meta tag use for security labels
  • from GForge
    • 3318 Clarify how to use RBAC and ABAC using FHIR ()
    • 8738 Unapplied QA changes around security and services ()
    • 9036 Handling of meta values that should force version, such as security_labels
    • 9037 Security page should recognize HEART
    • 9078 HTTP Caching Warning for FHIR GET REST services

Signatures Datatype

  • Signature Data Type
  • from GForge
    • 8827 Signature datatype does not include counter-signature type ()
    • 8731 Canonicalization for signatures ()
    • 7752 2015May core #1073 - Replace value set with FHIR Signer Type value set (Kathleen Connor) Not Related
    • 9082 Update of signature type displayNames

Not Security WG, but are listed as interested party

  • 5525 Consent Directive does not appear to be aligned with the 80% ()


Relation of Provenance and Audit Event, and Security Labels

  • Who records Provenance vs AuditEvent; what are the various architectures. The important point is to assure that the architecture chosen doesn't miss information.
  • Risks to Confidentiality, Integrity, and Availability.
  • Role of W5
  • Privacy Consent as a profile on Contract
Retrieved from "https://wiki.hl7.org/w/index.php?title=HL7_FHIR_security_topics&oldid=163810"