April 19, 2016 Security Conference Call
Back to Security Work Group Main Page
Attendees
| x | Member Name | x | Member Name | x | Member Name | |||
|---|---|---|---|---|---|---|---|---|
| x | Kathleen ConnorSecurity Co-chair | . | Duane DeCouteau | . | Chris Clark | |||
| x | John MoehrkeSecurity Co-chair | . | Johnathan Coleman | . | Aaron Seib | |||
| . | Alexander Mense Security Co-chair | . | Ken Salyards | . | Christopher D Brown TX | |||
| . | Trish WilliamsSecurity Co-chair | . | Gary Dickinson | x | Dave Silver | |||
| Mike Davis | . | Ioana Singureanu | . | Mohammed Jafari | ||||
| x | Suzanne Gonzales-Webb | . | Rob Horn | . | Galen Mulrooney | |||
| x | Diana Proud-Madruga | . | Ken Rubin | . | William Kinsley | |||
| x | Rick Grow | . | Paul Knapp | x | Mayada Abdulmannan | |||
| x | Glen Marshall, SRS | . | Bill Kleinebecker | . | Christopher Shawn | |||
| . | Oliver Lawless | . | [mailto | . | Serafina Versaggi | |||
| x | Beth Pumo | . | Russell McDonell | . | Paul Petronelli , Mobile Health | |||
| . | Christopher Doss | . | Kamalini Vaidya | . | [mailto: TBD ] |
Agenda DRAFT
- ( 5 min) Roll Call, Agenda Approval
- ( 5 min) Approve Security WG April 12, 2016 Minutes
- ( 15 min) Discuss Lloyd's suggestion - See Discussion Items below.
- (10 min) Privacy & Security by Design/NOW Privacy Impact Assessment - update - Rick
- Joint project meetings (ARB, CBCC, Security) held Tuesdays at 5 p.m. Eastern. Meeting information and invite
- ( 5 min) PASS Access Control Services Conceptual Model - Diana
- ( 5 min) Joint Vocabulary Alignment Update - Diana
- ( 5 min) PASS Audit Conceptual Model – Diana
- ( 5 min) FHIR Security report out - John
Note that there will be a FHIR Security call at 2pm PT/5pm ET See agenda at FHIR Security Agenda
Minutes
Discussion Items
Suggestion from Lloyd on capturing potential Privacy and Security issues in FHIR: "One thing we could do is add a QA rule expecting a "Security & Privacy Considerations" section in the Notes area for each resource. It would be a "warning" rule, meaning that work groups could ask for it to be suppressed for a given resource if they determine that there are none. That would help prompt work groups to think about it and also ensure a consistent place for it to appear. (General security considerations about the use of FHIR, including the passages Kathleen highlighted should be handled in the "Security" section of FHIR, I think rather than interspersed on all of the different pages.) If the security WG thinks this is a good idea, perhaps they could put together some bullet points highlighting the types of considerations they'd like work groups to consider when filling out the section. My leaning would be to make this an FMM 3 issue as it probably makes sense for the resource design to stabilize a bit before expecting WGs to go through a full security/privacy analysis."
